home

nvspcap64.dll

NVIDIA GeForce Experience

NVIDIA CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ShadowPlay’.
Publisher:
NVIDIA CORPORATION  (signed and verified)

Product:
NVIDIA GeForce Experience

Description:
NVIDIA Capture Server Proxy

Version:
12.4.55.0

MD5:
67358d048637cf8f389673dbd2e8c80a

SHA-1:
13c05c4df3b7c80b1133061a81993ea7a96bc2f6

SHA-256:
80154ed02402d20737ac69a42913072d3dc85bbfe75de5aff152cdadb9368839

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 8:51:48 AM UTC  (today)

File size:
1.2 MB (1,225,920 bytes)

Product version:
12.4.55.0

Copyright:
(C) NVIDIA Corporation. All rights reserved.

Original file name:
nvspcap.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\nvspcap64.dll

Digital Signature
Signed by:
NVIDIA CORPORATION

Authority:
NVIDIA Subordinate CA

Valid from:
7/15/2013 3:19:49 PM

Valid to:
7/15/2014 3:29:49 PM

Subject:
CN=NVIDIA CORPORATION

Issuer:
CN=NVIDIA Subordinate CA, DC=nvidia, DC=com

Serial number:
7D6C09D0000000000004

File PE Metadata
Compilation timestamp:
4/1/2014 9:02:52 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:hnBEpaaUs2d/Ht0gH8Y8klr32OoxAXAy9iZztpPGWwT:hBEprY/bPlrmOQAXAy9iZztpPGWwT

Entry address:
0xA0F24

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, D7, C4, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, B2, BF...
 
[+]

Entropy:
5.6625

Code size:
979 KB (1,002,496 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ShadowPlay

Command:
C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,shadowplayonsystemstart


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.