home

nvspcap64.dll

NVIDIA GeForce Experience

NVIDIA CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ShadowPlay’.
Publisher:
NVIDIA CORPORATION  (signed and verified)

Product:
NVIDIA GeForce Experience

Description:
NVIDIA Capture Server Proxy

Version:
11.10.11.1

MD5:
378eb75326ba9ae88c0a0e1d822f41b0

SHA-1:
31d8535f85d6893b1d810f1dff0181d3f8725bfc

SHA-256:
96efdebaea4a60ce7d75caa85976e316e2ec20862e2384aa1aea510c9f831125

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 10:59:34 AM UTC  (today)

File size:
1.1 MB (1,179,576 bytes)

Product version:
11.10.11.1

Copyright:
(C) NVIDIA Corporation. All rights reserved.

Original file name:
nvspcap.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\nvspcap64.dll

Digital Signature
Signed by:
NVIDIA CORPORATION

Authority:
NVIDIA Subordinate CA

Valid from:
7/15/2013 4:19:49 PM

Valid to:
7/15/2014 4:29:49 PM

Subject:
CN=NVIDIA CORPORATION

Issuer:
CN=NVIDIA Subordinate CA, DC=nvidia, DC=com

Serial number:
7D6C09D0000000000004

File PE Metadata
Compilation timestamp:
1/21/2014 3:45:50 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:blQIeXkyLoTGKM8NTFdT9wNjs9TAy9iZztpPGW/:5QIjoYG2zTSNKTAy9iZztpPGW/

Entry address:
0x9A168

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, AF, B8, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, DE, C2...
 
[+]

Code size:
946 KB (968,704 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ShadowPlay

Command:
C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,shadowplayonsystemstart


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.