nvsphelper64.exe
5637754cefd4962bb01a1508d0efcab513b4ea71d5fc923f4103cf1673218d9a
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 998,512 bytes |
| Preferred image base | 0x140000000 |
| Entry RVA | 0x79b0 |
| Imports / exports | 131 / 0 |
| Exception/unwind ranges | 1,871 |
| Executable raw bytes | 685,056 |
Physical paths:
NVIDIA App\ShadowPlay\nvsphelper64.exe
Decompilation coverage
Complete: 4,041 successful reconstructions, 0 failures, 4,041 attempted entries, 4,041 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
685,056 | 684,748 | yes / no / yes | 5.1871 |
.rdata |
0xa9000 |
686080 |
118,272 | 117,989 | yes / no / no | 4.3857 |
.data |
0xc6000 |
804352 |
7,168 | 17,832 | yes / yes / no | 1.7425 |
.pdata |
0xcb000 |
811520 |
25,088 | 24,996 | yes / no / no | 5.6278 |
.idata |
0xd2000 |
836608 |
6,656 | 6,360 | yes / no / no | 3.7679 |
.gfids |
0xd4000 |
843264 |
1,024 | 1,008 | yes / no / no | 2.4171 |
.00cfg |
0xd5000 |
844288 |
512 | 373 | yes / no / no | 0.4117 |
.tls |
0xd6000 |
844800 |
1,024 | 777 | yes / yes / no | 0.0112 |
.rsrc |
0xd7000 |
845824 |
136,704 | 136,408 | yes / no / no | 4.6524 |
.reloc |
0xf9000 |
982528 |
5,632 | 5,216 | yes / no / no | 2.9374 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.