ShadowPlayExt.dll

Description: NVIDIA ShadowPlay Install Helper

Version: 11.0.5.420

Architecture: 32-bit

Operating System: Windows

SHA256: 86bbf13ded13e98df6d62657b4285d70

File Size: 1.1 MB

Uploaded At: Dec. 1, 2025, 2:53 p.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0xac820)
DllGetClassObject (Ordinal: 2, Address: 0xac7e0)
DllInstall (Ordinal: 3, Address: 0xac7b0)
DllRegisterServer (Ordinal: 4, Address: 0xac7d0)
DllUnregisterServer (Ordinal: 5, Address: 0xac7c0)

Imported DLLs & Functions

ADVAPI32.dll

GetTokenInformation (Address: 0x100c3020)
LsaNtStatusToWinError (Address: 0x100c3000)
OpenProcessToken (Address: 0x100c301c)
RegCloseKey (Address: 0x100c302c)
RegCreateKeyExW (Address: 0x100c3028)
RegDeleteKeyW (Address: 0x100c3014)
RegDeleteValueW (Address: 0x100c3010)
RegEnumKeyExW (Address: 0x100c300c)
RegEnumValueW (Address: 0x100c3024)
RegOpenCurrentUser (Address: 0x100c3018)
RegOpenKeyExW (Address: 0x100c3030)
RegQueryInfoKeyW (Address: 0x100c3008)
RegQueryValueExW (Address: 0x100c3034)
RegSetValueExW (Address: 0x100c3004)

KERNEL32.dll

AreFileApisANSI (Address: 0x100c32a4)
ChangeTimerQueueTimer (Address: 0x100c31c0)
CloseHandle (Address: 0x100c3160)
CompareStringW (Address: 0x100c327c)
CreateDirectoryW (Address: 0x100c3118)
CreateEventA (Address: 0x100c30bc)
CreateEventW (Address: 0x100c3250)
CreateFileW (Address: 0x100c3174)
CreateMutexW (Address: 0x100c30cc)
CreateThread (Address: 0x100c32b4)
CreateTimerQueue (Address: 0x100c31a4)
CreateTimerQueueTimer (Address: 0x100c31c4)
CreateToolhelp32Snapshot (Address: 0x100c3108)
DecodePointer (Address: 0x100c3094)
DeleteCriticalSection (Address: 0x100c3074)
DeleteFileW (Address: 0x100c311c)
DeleteTimerQueueTimer (Address: 0x100c31bc)
DeviceIoControl (Address: 0x100c312c)
DuplicateHandle (Address: 0x100c30f4)
EncodePointer (Address: 0x100c309c)
EnterCriticalSection (Address: 0x100c3088)
EnumSystemLocalesW (Address: 0x100c3220)
ExitProcess (Address: 0x100c3238)
ExitThread (Address: 0x100c32b8)
ExpandEnvironmentStringsW (Address: 0x100c3180)
FindClose (Address: 0x100c3120)
FindFirstFileExA (Address: 0x100c3210)
FindNextFileA (Address: 0x100c320c)
FindResourceExW (Address: 0x100c3054)
FindResourceW (Address: 0x100c3050)
FlushFileBuffers (Address: 0x100c3298)
FormatMessageA (Address: 0x100c30b8)
FormatMessageW (Address: 0x100c30b4)
FreeEnvironmentStringsW (Address: 0x100c31f4)
FreeLibrary (Address: 0x100c314c)
FreeLibraryAndExitThread (Address: 0x100c32bc)
GetACP (Address: 0x100c3234)
GetCommandLineA (Address: 0x100c3200)
GetCommandLineW (Address: 0x100c31fc)
GetConsoleCP (Address: 0x100c31ec)
GetConsoleMode (Address: 0x100c31e8)
GetCPInfo (Address: 0x100c3288)
GetCurrentProcess (Address: 0x100c3184)
GetCurrentProcessId (Address: 0x100c30e0)
GetCurrentThread (Address: 0x100c3130)
GetCurrentThreadId (Address: 0x100c30c8)
GetDateFormatW (Address: 0x100c3230)
GetEnvironmentStringsW (Address: 0x100c31f8)
GetExitCodeThread (Address: 0x100c3084)
GetFileAttributesW (Address: 0x100c3170)
GetFileInformationByHandle (Address: 0x100c329c)
GetFileSizeEx (Address: 0x100c30d8)
GetFileType (Address: 0x100c3214)
GetFullPathNameW (Address: 0x100c3188)
GetLastError (Address: 0x100c3164)
GetLocaleInfoW (Address: 0x100c3284)
GetLogicalProcessorInformation (Address: 0x100c3294)
GetModuleFileNameA (Address: 0x100c3190)
GetModuleFileNameW (Address: 0x100c317c)
GetModuleHandleA (Address: 0x100c3168)
GetModuleHandleExW (Address: 0x100c30e8)
GetModuleHandleW (Address: 0x100c3150)
GetNumaHighestNodeNumber (Address: 0x100c31b8)
GetOEMCP (Address: 0x100c3204)
GetProcAddress (Address: 0x100c315c)
GetProcessAffinityMask (Address: 0x100c31b4)
GetProcessHeap (Address: 0x100c306c)
GetProcessId (Address: 0x100c30fc)
GetProcessTimes (Address: 0x100c30ac)
GetStartupInfoW (Address: 0x100c325c)
GetStdHandle (Address: 0x100c3218)
GetStringTypeW (Address: 0x100c3260)
GetSystemDirectoryW (Address: 0x100c316c)
GetSystemInfo (Address: 0x100c3138)
GetSystemTimeAsFileTime (Address: 0x100c30a8)
GetTempPathW (Address: 0x100c30e4)
GetThreadPriority (Address: 0x100c31c8)
GetThreadTimes (Address: 0x100c3148)
GetTickCount (Address: 0x100c3104)
GetTimeFormatW (Address: 0x100c322c)
GetTimeZoneInformation (Address: 0x100c321c)
GetUserDefaultLCID (Address: 0x100c3224)
GetVersionExW (Address: 0x100c313c)
HeapAlloc (Address: 0x100c3068)
HeapDestroy (Address: 0x100c3058)
HeapFree (Address: 0x100c3064)
HeapReAlloc (Address: 0x100c3060)
HeapSize (Address: 0x100c305c)
InitializeCriticalSectionAndSpinCount (Address: 0x100c3268)
InitializeCriticalSectionEx (Address: 0x100c3078)
InitializeSListHead (Address: 0x100c3254)
InterlockedFlushSList (Address: 0x100c32b0)
InterlockedPopEntrySList (Address: 0x100c3198)
InterlockedPushEntrySList (Address: 0x100c32ac)
IsDebuggerPresent (Address: 0x100c3258)
IsProcessorFeaturePresent (Address: 0x100c3248)
IsValidCodePage (Address: 0x100c3208)
IsValidLocale (Address: 0x100c3228)
LCMapStringW (Address: 0x100c3280)
LeaveCriticalSection (Address: 0x100c308c)
LoadLibraryExW (Address: 0x100c3040)
LoadLibraryW (Address: 0x100c30ec)
LoadResource (Address: 0x100c304c)
LocalAlloc (Address: 0x100c3178)
LocalFree (Address: 0x100c3158)
LockResource (Address: 0x100c3048)
lstrcmpW (Address: 0x100c303c)
MoveFileExW (Address: 0x100c3134)
MultiByteToWideChar (Address: 0x100c3114)
OpenEventA (Address: 0x100c3290)
OpenProcess (Address: 0x100c3100)
OutputDebugStringW (Address: 0x100c30b0)
Process32FirstW (Address: 0x100c310c)
Process32NextW (Address: 0x100c3110)
QueryDepthSList (Address: 0x100c319c)
QueryDosDeviceW (Address: 0x100c3124)
QueryPerformanceCounter (Address: 0x100c30a0)
QueryPerformanceFrequency (Address: 0x100c30a4)
RaiseException (Address: 0x100c3098)
ReadConsoleW (Address: 0x100c31dc)
ReadFile (Address: 0x100c31e4)
RegisterWaitForSingleObject (Address: 0x100c31ac)
ReleaseMutex (Address: 0x100c30dc)
ReleaseSemaphore (Address: 0x100c328c)
RemoveDirectoryW (Address: 0x100c30d0)
ResetEvent (Address: 0x100c324c)
ResumeThread (Address: 0x100c3090)
RtlUnwind (Address: 0x100c32a8)
SetEnvironmentVariableA (Address: 0x100c31f0)
SetEvent (Address: 0x100c30c0)
SetFileAttributesW (Address: 0x100c3128)
SetFilePointerEx (Address: 0x100c32a0)
SetLastError (Address: 0x100c318c)
SetStdHandle (Address: 0x100c31e0)
SetThreadAffinityMask (Address: 0x100c31b0)
SetThreadPriority (Address: 0x100c31cc)
SetUnhandledExceptionFilter (Address: 0x100c3244)
SignalObjectAndWait (Address: 0x100c31d4)
SizeofResource (Address: 0x100c3044)
Sleep (Address: 0x100c323c)
SwitchToThread (Address: 0x100c31d0)
TerminateProcess (Address: 0x100c30f8)
TerminateThread (Address: 0x100c3080)
TlsAlloc (Address: 0x100c326c)
TlsFree (Address: 0x100c3278)
TlsGetValue (Address: 0x100c3270)
TlsSetValue (Address: 0x100c3274)
TryEnterCriticalSection (Address: 0x100c3264)
UnhandledExceptionFilter (Address: 0x100c3240)
UnregisterWait (Address: 0x100c31a8)
UnregisterWaitEx (Address: 0x100c31a0)
VerifyVersionInfoW (Address: 0x100c30f0)
VerSetConditionMask (Address: 0x100c3154)
VirtualAlloc (Address: 0x100c3144)
VirtualFree (Address: 0x100c3194)
VirtualProtect (Address: 0x100c3140)
WaitForSingleObject (Address: 0x100c307c)
WaitForSingleObjectEx (Address: 0x100c30c4)
WideCharToMultiByte (Address: 0x100c3070)
WriteConsoleW (Address: 0x100c31d8)
WriteFile (Address: 0x100c30d4)

ole32.dll

CoCreateInstance (Address: 0x100c3340)
CoInitializeEx (Address: 0x100c3344)
CoUninitialize (Address: 0x100c333c)

OLEAUT32.dll

LoadRegTypeLib (Address: 0x100c32e8)
LoadTypeLib (Address: 0x100c32ec)
SafeArrayCopy (Address: 0x100c32e0)
SafeArrayDestroy (Address: 0x100c32f0)
SafeArrayGetLBound (Address: 0x100c32f8)
SafeArrayGetUBound (Address: 0x100c32f4)
SafeArrayGetVartype (Address: 0x100c32fc)
SafeArrayLock (Address: 0x100c3300)
SafeArrayUnlock (Address: 0x100c32c4)
SysAllocString (Address: 0x100c32e4)
SysAllocStringLen (Address: 0x100c32dc)
SysFreeString (Address: 0x100c32c8)
SysStringLen (Address: 0x100c32d4)
VariantChangeType (Address: 0x100c32d8)
VariantClear (Address: 0x100c32cc)
VariantInit (Address: 0x100c32d0)

PSAPI.DLL

GetProcessImageFileNameW (Address: 0x100c3308)

SHELL32.dll

SHGetFolderPathW (Address: 0x100c3310)

SHLWAPI.dll

PathFindFileNameW (Address: 0x100c3318)

USER32.dll

EnumWindows (Address: 0x100c3330)
GetParent (Address: 0x100c3328)
GetWindow (Address: 0x100c3324)
GetWindowThreadProcessId (Address: 0x100c332c)
IsWindowVisible (Address: 0x100c3320)
PostMessageW (Address: 0x100c3334)