cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
publish/Ryujinx.exe
Size 70.0MB
Sample260605-2agsxaev4x
SHA256 cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0
MD5 98a17043b9b91d84e470568e2c6daa87
SHA1 240b5a6e408b123e8dd002cbd3871ad9c9d849c1
SHA512 7ef214e65eeb719ac997c548640f7fed13e3168c40effdeb54862a0f773c96ca8badd36a992de5946d73d79b3cc839adaa2882ffd634ae3751d84c70c802fa8f
SSDEEP 393216:MWwKLxxKbJrS/AkbjBjZITGSI8rPPRz7e7Oc8d4ye937wtG6:ByYFGzPNe7V8d5K37wtn
TLSH
T1F3F7AD05E7D88E2AD1BF8334903110119776F45B6362EB8F714CE2F82F677944E6A6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Ryujinx.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Ryujinx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Ryujinx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Ryujinx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Ryujinx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	Ryujinx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	Ryujinx.exe

C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe"
1⤵
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imkvdb.arc

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\0\imkvdb.arc
Size 12B
SHA256 f2dcb07cab0cf427a9b304b36a6e803277e59c8082f0235312abc0c75d2945e7
MD5 9e32cad5e04d1f511b7bb140a8ff77f3
SHA1 e449c76751eda0f70b7e7070469c416c47371c20
SHA512 3d0339e5b376a7d7a8658058c32d786d0ed6a15f1580136a558178e14652464337344e720c78e76b92c754289d559b855b5cd0086a0d0a2ba7bb012d613fedf0
MD5 SHA1 SHA512

Submit Download

ExtraData0

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData0
Size 512B
SHA256 c5231b830b86d334d0eec62a94de981c531d5b63a39d0a4afb70a2dbd09fdfe7
MD5 2671fdd55357d70556fc1b9386a105a7
SHA1 32d72b964d6ec1a4b3954e4c3e1a4d6db54cf892
SHA512 bf24b793cf5758d52f920545844aaef6e67c159b25c2acfb6713e0f9d2505bafa80f96d87606808d14d3ecad53f8dabc20dbafd3cda8697dd4764c642d610e67
MD5 SHA1 SHA512

Submit Download

ExtraData_

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
Size 512B
SHA256 b96179b7b0c5cd37ef6f556328e8e7db50085c15133a0faf6f403d839fbd427b
MD5 43b666442264041415ea212554bf0ad6
SHA1 ec61536d996c9cd3cfb9efa8e02d3242206cd0fe
SHA512 2a37e73593f704b83a20bb1c0e5271217190a90804de63fed946c4c029f7d38e453449c83f2edfe74f5d7345b95d62ff3ad5fa3307c9dcd8a579908d3b38a844
MD5 SHA1 SHA512

Submit Download

ExtraData_

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
Size 512B
SHA256 6dcd5db7d7ec377679f241da9425f45784507f00af1a31b76db1e3b933f04b99
MD5 d849667a689111935ef6e5e382004e4f
SHA1 807162e44aa386c3b3ef093f8045ac4774c1a2d1
SHA512 621e1b1fde699e2a8b7baf032fd29f8f418c23aaeb1c081b1f920818f9d69529c00f7b0ff851dee9d954b0efabd22d4a485cb490d696f3dd41ebf628c3a54353
MD5 SHA1 SHA512

Submit Download

ExtraData_

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
Size 512B
SHA256 2f6cdd596910235741c169d16b0bf4f135e3f6739394279cdda1dc0dbe3321eb
MD5 0a215fe75d955d8c204afe302c0d5ea7
SHA1 a2dea9b2d0a98b7fdc5d1affd783533d3aaa2167
SHA512 9340d736dce78a325eb3451601b4b900b89b77afa1e865274e2b0f9beb618d83a9f6fadb95569875a69f8840a401a01d3971306536592430f7e6eef227b29ccd
MD5 SHA1 SHA512

Submit Download

lastPublishedId

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\_\lastPublishedId
Size 8B
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads