home

nvspcap64.dll

NVIDIA GeForce Experience

NVIDIA CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ShadowPlay’.
Publisher:
NVIDIA CORPORATION  (signed and verified)

Product:
NVIDIA GeForce Experience

Description:
NVIDIA Capture Server Proxy

Version:
12.4.67.0

MD5:
89923e0a5df33927e176e0d9b7f1297d

SHA-1:
f5124bd0e6553128d5898e296224983c213652d1

SHA-256:
932300bc84bc45fcdc189a0b541d55fd8bebeabc2ccb95cb286c1c0aa7f67ecd

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/20/2024 2:31:57 AM UTC  (today)

File size:
1.2 MB (1,225,920 bytes)

Product version:
12.4.67.0

Copyright:
(C) NVIDIA Corporation. All rights reserved.

Original file name:
nvspcap.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\nvspcap64.dll

Digital Signature
Signed by:
NVIDIA CORPORATION

Authority:
NVIDIA Subordinate CA

Valid from:
7/15/2013 4:19:49 PM

Valid to:
7/15/2014 4:29:49 PM

Subject:
CN=NVIDIA CORPORATION

Issuer:
CN=NVIDIA Subordinate CA, DC=nvidia, DC=com

Serial number:
7D6C09D0000000000004

File PE Metadata
Compilation timestamp:
4/29/2014 3:58:19 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:bnBEpaaUs2d/Ht0gH8Y8klr323oxAXAy9iZztpPGWwl:bBEprY/bPlrm3QAXAy9iZztpPGWwl

Entry address:
0xA0F24

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, D7, C4, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, B2, BF...
 
[+]

Code size:
979 KB (1,002,496 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ShadowPlay

Command:
C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,shadowplayonsystemstart


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.