File scan report
Verdict Safe
Is CL [number] safe? Yes, no threats found.
The NVIDIA-signed DLL drew no flags from 75 engines, and its completed sandbox run produced no corroborated harmful activity or malicious artifacts.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Use the DLL if it came through an official NVIDIA installation or update channel and its signature remains valid. Keep security protection enabled and investigate if it appears in an unexpected directory or application bundle.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing NVIDIA Corporation
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The DLL carries a verified NVIDIA Corporation signature, and none of the 70 antivirus engines that checked it flagged it.
None of the 70 antivirus engines that checked it flagged the DLL, including the major antivirus engines represented in the results. Its digital signature verifies to NVIDIA Corporation, which matches a curated trusted publisher. The completed sandbox run did not produce a malicious verdict, persistence indicators, injected processes, or dropped files. Although the run mapped T1562.001, that isolated mapping is outweighed by the absence of corresponding artifacts and by nine technique common in legitimate software mappings. The antivirus analysis also found no packer or high-entropy code, while researcher intelligence produced no malware-specific rule matches. Host-reputation coverage was not completed, so no claim is made that every possible network destination was checked.
What We Detected
None of the 70 antivirus engines that checked it flagged this 64-bit Windows DLL. The file has a verified digital signature from NVIDIA Corporation, and the signer matches a curated trusted publisher. Static PE analysis found no identified packer, no likely packing, and no high-entropy code.
Threat Behavior
One completed sandbox run returned a clean result. It observed DLL loading through rundll32 and Windows error-reporting activity, but no process injection, persistence indicators, registry changes, or files it created. T1562.001 was mapped once; however, no engine detection, malware-specific YARA rule, or harmful runtime artifact corroborated defense impairment. The sole recorded IP contact was classified as analysis-environment background traffic, and no complete host-reputation cross-check is available.
What To Do Now
Confirm that the file came from an official NVIDIA installation or update location before deploying it. Keep security software enabled and rescan if the signature becomes invalid, the file appears outside expected NVIDIA paths, or new detections emerge.
Where this verdict could be wrong3 caveats
- The sandbox mapped T1562.001, a defense-impairment technique, although no corresponding malicious outcome or artifact was observed.
- No complete contacted-host reputation result is available; the only recorded IP was identified as sandbox background traffic rather than sample activity.
- No historical signer statistics or similar-hash verdicts are available to provide additional longitudinal corroboration.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file.
- The digital signature verifies to NVIDIA Corporation, a trusted publisher.
- The completed sandbox run found no persistence, process injection, or files it created.
- The antivirus analysis found no packing or high-entropy code.
- Research intelligence returned no malware-specific rule matches.
- The sandbox mapped one defense-impairment technique, but no related harmful artifact was observed.
- The generic filename does not identify the DLL's product role or expected installation path.
- A complete reputation check of contacted hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 8spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1071· Application protocol
- T1082· System recon
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1574· Execution hijack
Observed activity
Processes started
8Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\init.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\init.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,NGX_SNIPPETS_GetRequiredDriverSupportrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,NVSDK_NGX_CUDA_CreateFeature
Show all 8 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,NVSDK_NGX_CUDA_CreateFeature1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",NGX_SNIPPETS_GetRequiredDriverSupport
Files
7Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\21136676-6b5b-4ae9-9674-902e2ccc87ed - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\b474dc64-a3e7-4a14-9ae1-7aa3626fa815 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\ff569cc4-efe3-4507-bf2c-fd94eb33a00e
Show all 7 entries for files
- Written
\Device\ConDrv\\Connect
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2088 -s 580 - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6860 -s 384 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5960 -s 380 - VM host
162.159.36.2
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by NVIDIA Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 4:42 PM UTC
- SHA-256
3975567b8943c53acce397f2b72380092f84f162d00b0d2c7d08a1025c563983- SHA-1
61349e36573b0dbb95287781bf229524624169ad- MD5
a0dac8ab01c00f56a1de1bc383f4147c
About this file
CL [number] is a Win32 DLL file of 59.0 MB.
- Type and size
- Win32 DLL · 59.0 MB
- Signer
- NVIDIA CorporationValid code signature.
- First seen
- Sep 8, 2026On VirusTotal.
- Submitted by
- 382 distinct sources
- Packer
- None detected
- Entropy
- 5.91 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is CL [number] safe?
What is CL [number]?
How many antivirus engines detected CL [number]?
Is CL [number] digitally signed?
What is the SHA-256 hash of CL [number]?
Is it safe to use CL [number]?
How up to date is this analysis of CL [number]?
Community
Member reviews and reports for this exact file hash.