Is nopgg.upl safe?
Thirty-two of 75 engines flagged this DLL, including 10 tier-1 detections, while runtime evidence mapped possible process injection and defense impairment.
The DLL drew 32 detections from 75 engines, including 10 tier-1 products; ESET-NOD32 and Fortinet independently named GenCBL. A completed sandbox also mapped activity to process injection and defense impairment, while the verified certificate has no trusted-publisher match or established history.
b6098b3d0207cc1198…9a404b2a313b89Recommended next actions
Before opening
Do not open it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already opened it
Close it. If it opened links, requested credentials, or triggered unexpected behavior, disconnect from the internet and run a full device scan.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The DLL drew 32 detections from 75 engines, including 10 tier-1 products; ESET-NOD32 and Fortinet independently named GenCBL. A completed sandbox also mapped activity to process injection and defense impairment, while the verified certificate has no trusted-publisher match or established history.
Detection volume is substantial: 32 of 75 engines flagged the file, with 10 tier-1 products participating. ESET-NOD32 and Fortinet agree on GenCBL, although the two-engine family agreement falls short of strong consensus and several products use other generic trojan names. Runtime evidence maps activity to T1055 process injection and T1562.001 defense impairment, reinforcing the engine findings. The signature verifies as belonging to PT. Indosakti Karya Presisi, but that publisher is not curated as trusted and has no historical sample record here. Both observed domains were covered by the host-reputation check without cached warnings, and no dropped child was identified as malware, but those counter-signals are insufficient against the broader evidence.
What We Detected
Thirty-two of 75 antivirus engines flagged this Win32 DLL. Ten tier-1 products detected it, including ESET-NOD32 and Fortinet identifying GenCBL, Microsoft identifying Wacatac, and Sophos identifying Isher. The family labels vary, but the breadth and quality of detections strongly support a generic trojan assessment.
Threat Behavior
One completed sandbox run mapped activity to T1055 process injection and T1562.001 defense impairment. The sample was also launched through rundll32.exe, which is consistent with DLL execution and can be abused by malware. Both observed domains were checked against the available host cache and had no malicious or suspicious entries, and none of the six dropped files was identified as a malicious child; however, those children remain individually unclassified.
What To Do Now
Do not execute or load this DLL. Quarantine or remove it with endpoint protection kept enabled, then scan the system and investigate any rundll32.exe activity associated with the file or its hash.
Where this verdict could be wrong5 caveats
- signing.verified=true for 'PT. Indosakti Karya Presisi', although signing.trustedPublisher.matched=false and no signer history is available.
- contactedHosts.inspected=2 covers the two observed domains and lists 0 malicious and 0 suspicious hosts.
- droppedChildren.hasMaliciousChild=false, although all 6 inspected children remain without individual verdicts.
- externalIntel.yaraify.ruleCount=0 and externalIntel.malwareBazaar.hit=false, so no researcher-rule or repository corroboration was obtained.
- engines.tier1FamilyConsensus.strong=false because only 2 tier-1 engines agree on GenCBL, and several other detections use differing generic families.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The code-signing certificate verifies for PT. Indosakti Karya Presisi.
- Both observed domains were fully covered by the host check with no cached malicious or suspicious results.
- droppedChildren.hasMaliciousChild=false.
- No YARAify or MalwareBazaar corroboration was present.
- peAnalysis.highEntropyCode=false and peAnalysis.likelyPacked=false.
- 32 of 75 engines reported malicious detections.
- Ten tier-1 engines flagged the sample.
- ESET-NOD32 and Fortinet independently identified GenCBL.
- Runtime evidence includes T1055 process injection.
- Runtime evidence includes T1562.001 defense impairment.
- The verified signer has no trusted-publisher match or established historical record.
Quarantine the DLL and run a full endpoint scan while keeping all security protections enabled. Review rundll32.exe execution records and isolate the host if related injection or defense-tampering activity is found.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete32 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Complete2 contacted hosts were cross-checked.
YARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 11MITRE ATT&CK techniques
- 15spawned processes
- 2network contacts
- 31filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Attempted to impair or bypass security controls.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Moderate concern: Checks which security software you have installed.
Note: Listed running processes; both legitimate software and malware may do this.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
nopgg.upl
b6098b3d0207cc119805aec20f7141a6d90c9fc3da785a8a289a404b2a313b89
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 740
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
Temp
C:\ProgramData\Microsoft\Windows\WER\Temp
04Isolated runtime analysis - Written fileObserved
107cd367-b939-4346-88f8-3f056109701c
C:\ProgramData\Microsoft\Windows\WER\Temp\107cd367-b939-4346-88f8-3f056109701c
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
bg.microsoft.map.fastly.net
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
cl-glcb907925.gcdn.co
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- bg.microsoft.map.fastly.net
- cl-glcb907925.gcdn.co
- \REGISTRY\A\{7644056b-b333-bab6-b9c4-129a114b100a}\Root\InventoryApplicationFile\PermissionsCheckTestKey
- \REGISTRY\A\{7644056b-b333-bab6-b9c4-129a114b100a}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
- HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\IdentityCRL\ClockData
- \REGISTRY\A\{7644056b-b333-bab6-b9c4-129a114b100a}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\ProgramId
- \REGISTRY\A\{7644056b-b333-bab6-b9c4-129a114b100a}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\FileId
- \REGISTRY\A\{7644056b-b333-bab6-b9c4-129a114b100a}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\LowerCaseLongPath
- C:\ProgramData\Microsoft\Windows\WER\Temp
- C:\ProgramData\Microsoft\Windows\WER\Temp\107cd367-b939-4346-88f8-3f056109701c
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue
- C:\ProgramData\Microsoft\Windows\WER\Temp\07aa9d32-6390-4713-983b-b3893f3004b2
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive
- C:\ProgramData\Microsoft\Windows\WER\Temp\WEREABD.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERF156.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERF510.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WEREABD.tmp.dmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERF156.tmp.WERInternalMetadata.xml
- Local\WERReportingForProcess7004
- Global\AmiProviderMutex_InventoryApplicationFile
- Global\87ff83b0-e576-421b-bdfa-db661f1ffa53
- \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5444
- \Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex4632
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- e76810533ae8c6dee464…782285Never scannednever seen before
- 98e55755567c92431cec…bf88bbNever scannednever seen before
- d436f855a8cc5a721977…0e4c61Never scannednever seen before
- ced57884f6bf506c6dee…7dfcf7Never scannednever seen before
- c1ef3835553a2c0e0965…24c023Never scannednever seen before
- 2905c92a9471c7ed83ad…a2694aNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 32 / 75engines flagged
- 14sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
32 of 75 antivirus engines flagged the file, including alibabacloud and Avast.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The file has a valid code signature from PT. Indosakti Karya Presisi.
ProvenanceObservedSourceCode-signing metadataObserved at - 04
Scanned file: nopgg.upl — b6098b3d0207cc119805aec20f7141a6d90c9fc3da785a8a289a404b2a313b89
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 740
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: Temp — C:\ProgramData\Microsoft\Windows\WER\Temp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: 107cd367-b939-4346-88f8-3f056109701c — C:\ProgramData\Microsoft\Windows\WER\Temp\107cd367-b939-4346-88f8-3f056109701c
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: bg.microsoft.map.fastly.net — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: cl-glcb907925.gcdn.co — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1
32 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- nopgg.upl
- Format
- Win32 DLL
- Code signing
- Signature valid: PT. Indosakti Karya Presisi
- Size
- 630.3 KB
- Last analyzed
- Oct 8, 2026, 2:45 PM UTC
b6098b3d0207cc119805aec20f7141a6d90c9fc3da785a8a289a404b2a313b89Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't open this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already opened it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the original trusted source and verify its exact hash when possible.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is nopgg.upl malware?
What is nopgg.upl?
How many antivirus engines detected nopgg.upl?
I already downloaded and opened nopgg.upl — what should I do?
How do I remove nopgg.upl?
What kind of malware is nopgg.upl?
Is nopgg.upl digitally signed?
What is the SHA-256 hash of nopgg.upl?
How up to date is this analysis of nopgg.upl?
Community
Member reviews and reports for this exact file hash.