home

nvspcap64.dll

NVIDIA GeForce Experience

NVIDIA CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ShadowPlay’.
Publisher:
NVIDIA CORPORATION  (signed and verified)

Product:
NVIDIA GeForce Experience

Description:
NVIDIA Capture Server Proxy

Version:
11.10.13.1

MD5:
52a94bcdee1d8fa54b956a07408b7610

SHA-1:
a0b666de9f50afdadb39ab1d1767bd8b37a68827

SHA-256:
726b673772a76b68eee2187087396af46dac60aa839766d1989727926ed98269

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/10/2024 9:47:33 PM UTC  (today)

File size:
1.1 MB (1,179,576 bytes)

Product version:
11.10.13.1

Copyright:
(C) NVIDIA Corporation. All rights reserved.

Original file name:
nvspcap.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\nvspcap64.dll

Digital Signature
Signed by:
NVIDIA CORPORATION

Authority:
NVIDIA Subordinate CA

Valid from:
7/15/2013 4:19:49 PM

Valid to:
7/15/2014 4:29:49 PM

Subject:
CN=NVIDIA CORPORATION

Issuer:
CN=NVIDIA Subordinate CA, DC=nvidia, DC=com

Serial number:
7D6C09D0000000000004

File PE Metadata
Compilation timestamp:
2/5/2014 10:19:36 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:jlQIeXkyLoTGKM8NTFdT9wNTs9zAy9iZztpPGWF:RQIjoYG2zTSNazAy9iZztpPGWF

Entry address:
0x9A168

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, AF, B8, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, DE, C2...
 
[+]

Code size:
946 KB (968,704 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ShadowPlay

Command:
C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,shadowplayonsystemstart


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.