cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
publish/Ryujinx.exe
Size 70.0MB
Sample260605-2agsxaev4x
SHA256 cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0
MD5 98a17043b9b91d84e470568e2c6daa87
SHA1 240b5a6e408b123e8dd002cbd3871ad9c9d849c1
SHA512 7ef214e65eeb719ac997c548640f7fed13e3168c40effdeb54862a0f773c96ca8badd36a992de5946d73d79b3cc839adaa2882ffd634ae3751d84c70c802fa8f
SSDEEP 393216:MWwKLxxKbJrS/AkbjBjZITGSI8rPPRz7e7Oc8d4ye937wtG6:ByYFGzPNe7V8d5K37wtn
TLSH
T1F3F7AD05E7D88E2AD1BF8334903110119776F45B6362EB8F714CE2F82F677944E6A6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Ryujinx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Ryujinx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Ryujinx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Ryujinx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	Ryujinx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
988	Ryujinx.exe

C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imkvdb.arc

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\0\imkvdb.arc
Size 12B
SHA256 f2dcb07cab0cf427a9b304b36a6e803277e59c8082f0235312abc0c75d2945e7
MD5 9e32cad5e04d1f511b7bb140a8ff77f3
SHA1 e449c76751eda0f70b7e7070469c416c47371c20
SHA512 3d0339e5b376a7d7a8658058c32d786d0ed6a15f1580136a558178e14652464337344e720c78e76b92c754289d559b855b5cd0086a0d0a2ba7bb012d613fedf0
MD5 SHA1 SHA512

Submit Download

ExtraData0

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData0
Size 512B
SHA256 a21ec80704a612148e52405113b83a121d768c676e5e9dda799be7d857bbc5d9
MD5 d3390496d30bdb65a780a20f6336b602
SHA1 404030d944ed3ae15bd2401f90c89cda90f02974
SHA512 55206cbaff6c18fd7599d97462a6e43555d7d50b1f74e1f6ba6d72ca2d6ddffc22c5b9e2c6b416b5a51eb4013981183e546955c984c1b0bca953d28abaa64dea
MD5 SHA1 SHA512

Submit Download

ExtraData1

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData1
Size 512B
SHA256 f702a42ef3a62247c26236167eeb5ecdb7ae9d0f3c2d1ca01113d49db1a599fc
MD5 12492c4fc664d72f96751a237febd5fe
SHA1 158452f8ff9725b83c3d8dbe0cf50dff8674c01d
SHA512 5cfba06988501067bb23a29ebe23ec9c30b0e697b8ed5a5f852a82a12bbc607ac6a894b40dabf39c3270191275badbb06f11f79c5a6282b41f0b1c3bb30a103e
MD5 SHA1 SHA512

Submit Download

ExtraData_

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
Size 512B
SHA256 dceb4a266f37fe2f91ded196e7908a572385fce7ed6d5eea32d5f78f5f667fa1
MD5 e44fdf06f1be672e4636f70fb7fdba6d
SHA1 2e9f7e5ae964fccfb4c165b581a86063cbbab7c5
SHA512 7338f78d8981a52af572c65b7f5503ec0b585b6f79b2a7f52ed76ed04992bb77f2394ccdd3a598832a8b203e8429bd89941ea082d28cecf8a0fd9f0d0467b877
MD5 SHA1 SHA512

Submit Download

ExtraData_

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
Size 512B
SHA256 8bd4f97b7fab653562055893f545b7039e89ca49eca27c8b11808e5140aebce5
MD5 7cc884c894f4b466df3b14ab7c680b64
SHA1 0a1837b1856d9993457fef3918a415e0adcd62c4
SHA512 a381292d17c1377aefe14645b7c89f4ce55da8b1fc50cd8c5a1c1109953dd567006e3a90f45d2bc319ff74f08e37beb362f587a3a6257e8e8c2c2459fdfdb411
MD5 SHA1 SHA512

Submit Download

lastPublishedId

Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\_\lastPublishedId
Size 8B
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads