home

nvspcap64.dll

NVIDIA GeForce Experience

NVIDIA CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ShadowPlay’.
Publisher:
NVIDIA CORPORATION  (signed and verified)

Product:
NVIDIA GeForce Experience

Description:
NVIDIA Capture Server Proxy

Version:
10.11.15.0

MD5:
e2a16b931cd79259d568842fd1a8952e

SHA-1:
4234d33c6f89829c147b10357ed1b30eea44813f

SHA-256:
8f72a4029c58e301e9eae5321e4d9d090abfcc627d6e20e8096e7db754a1d3a8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 7:49:38 AM UTC  (today)

File size:
1 MB (1,100,248 bytes)

Product version:
10.11.15.0

Copyright:
(C) NVIDIA Corporation. All rights reserved.

Original file name:
nvspcap.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\nvspcap64.dll

Digital Signature
Signed by:
NVIDIA CORPORATION

Authority:
NVIDIA Subordinate CA

Valid from:
7/15/2013 3:19:49 PM

Valid to:
7/15/2014 3:29:49 PM

Subject:
CN=NVIDIA CORPORATION

Issuer:
CN=NVIDIA Subordinate CA, DC=nvidia, DC=com

Serial number:
7D6C09D0000000000004

File PE Metadata
Compilation timestamp:
12/10/2013 2:01:27 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:oaKdmDH+RbIVpU45Q9aGPmrO2q/5XvCMO02Ay9iZztpPGc:oaKdmD9LCadO2qR/CMuAy9iZztpPGc

Entry address:
0x907E0

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, A3, 87, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, AE, DC...
 
[+]

Entropy:
5.6127

Code size:
892 KB (913,408 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ShadowPlay

Command:
C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,shadowplayonsystemstart


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.