requirements[.]exe

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

requirements.exe

IMPHASH 9b5ef063ac31ccf7d26131466e9e89e5
SHA256 142c234f09a9618d7cdc2c37f607d6fc06615fad5581f728b60d4ad659f906bd
MD5 72ff4fd033852a4c0e2cb70bec4966b8
SHA1 a0eeecbd3dd973853f868cb80a4c80252ee17d1a
SHA512 bb3d95058daa7847785a7118896aebd068770dd3b7a16bc291fc595ee89059e34b064fe5daac54269d4042a107b2af260e7108111b563540623845919c2ffa45
SSDEEP 24576:kyD/5zh/wN3x8jFy7VuREJOYEvB3WHCmRjoE/aADHUuhum+/hmXgCMeGMHSmWLKq:1qN3ajFKwEJ1LRjBHHRum+/hmrJq
TLSH
T1345523516E94D2B2D6BB5EF2AF32037BCFB7BC0276A0C64F2348C60C5D65946A60C791
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d5:08:70:fa:d1:c4:77:06:ee:a6:7a:e2:f2:43:25:56:c9:ea:1c:4c:43:5b:30:69:f5:07:df:2d:f1:7e:d0:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 4, 2026

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

06:75:d6:b5:9e:f1:b0:ab:30:e5:d2:e0:46:da:24:31

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Jun 9, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

15124

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos IsDlgButtonChecked GetAsyncKeyState CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW CharNextA CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint PeekMessageW DispatchMessageW wvsprintfW SystemParametersInfoW wsprintfA CreatePopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW GetLastError MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/NPFInstall.exe

IMPHASH 27760b43b766b3f86ec66368fc404640
SHA256 f972c0cb631dfb53a27140c153ed0cdb9f177ba1515bb0f44c31ab0ef8386161
MD5 5915390eaa9f873fc8e2ef64aced6d79
SHA1 f785f0f1a40ce78d4aa748c30d2bf90b29d3d39d
SHA512 16def791ef7a80e48c5fc93742dfc9dd354774a5ecde66b008d8e7591d88e145f1f5a28fe92dd44028df5c23b52aa7ae2968084ff5f6f2586eb3958807f12292
SSDEEP 3072:EeAL76F10EE0nPlEaK76AthJWpOGzo9G5Wg9TNy5ifPaNbsNq+rY1p9r33utWoIT:676cENiexW2XnTNfrYxjetSUlqLZctmD
TLSH
T18E445A11BEE1C432F2B21D715D7586A65E3EBC602F3099CF538049BA9A71AD09B34B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

31:27:64:a2:c4:b6:e4:a3:db:d2:dc:07:46:85:9b:ad:96:70:0a:8b:2d:4e:51:9e:49:3d:33:76:dc:73:06:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 3, 2026

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

06:75:d6:b5:9e:f1:b0:ab:30:e5:d2:e0:46:da:24:31

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Jun 9, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

45824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\bonsa\source\repos\npcap\packetWin7\vs14\Release\NPFInstall.pdb

setupapi

CM_Get_Device_ID_ExW SetupDiGetDeviceInstallParamsW SetupDiGetClassDevsExW SetupDiClassGuidsFromNameExW SetupDiGetDeviceInfoListDetailW SetupDiCallClassInstaller SetupDiCreateDeviceInfoListExW SetupDiGetDeviceInstanceIdW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDevRegKeyW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupCopyOEMInfW

psapi

EnumProcessModulesEx GetModuleFileNameExW

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindFirstFileW SetLastError FindClose GetCurrentThreadId Sleep GetLastError GetLocalTime GetFullPathNameW GetModuleFileNameW GetFileAttributesW FormatMessageW DeleteFileW LoadLibraryW GetProcAddress LocalFree VerSetConditionMask FreeLibrary VerifyVersionInfoW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection ReadFile SetHandleInformation GetStringTypeW CreatePipe MultiByteToWideChar CloseHandle CreateProcessW GetConsoleWindow SetConsoleTitleW HeapFree GetCurrentProcess DeviceIoControl TerminateProcess WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetTickCount64 Process32NextW Process32FirstW HeapAlloc GetCurrentProcessId GetProcessHeap LCMapStringW CompareStringW VirtualProtect HeapSize HeapReAlloc GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW SetEndOfFile FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA WriteFile GetModuleHandleExW ExitProcess ReadConsoleW GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlUnwind EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

user32

CharNextW CharPrevW ShowWindow

advapi32

RegOpenKeyExW RegCloseKey OpenProcessToken RegGetValueW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitializeSecurity CoInitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

advpack

LaunchINFSectionExW

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/SysRestore.dll

IMPHASH aa88191a9382bec9c5b80dd5eeb8e542
SHA256 49b0450567c281494620193d0f3598bad8a474ae9910fedb161855f09a8ec1f0
MD5 d1a3f71186e20741b2bb0cc33ca79609
SHA1 b04761c0b7bc46e864a776514e4476eb372ef73c
SHA512 7eb904e4d2a6d87bccbe3e3f6562e53940195303a8024d2b0dad142a7a546b7a7a9287966e6d696246349008966349b6b56a3ce47978dedf49205bcfeb962b16
SSDEEP 192:Qa8pU6GVdndRqSzNJw7YUXmZscF8Bd1LAeVBZHlA6u/:upZGVdndRqSzNqZmZsHLAOhk
TLSH
T1434219768B941C52ED639A3138E4CA166F347241BB90C5EB121EC0649F41BD2BDBC36A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b6:13:60:9a:53:5f:40:23:63:fb:14:8e:ae:fb:91:c4:57:43:d9:f1:48:e0:65:ea:31:2e:d3:7a:a8:49:3e:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=200010310013,CN=Insecure.Com LLC,O=Insecure.Com LLC,L=Seattle,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 4, 2021

SERIALNUMBER=200010310013,CN=Insecure.Com LLC,O=Insecure.Com LLC,L=Seattle,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=200010310013,CN=Insecure.Com LLC,O=Insecure.Com LLC,L=Seattle,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0a:a6:07:83:eb:b5:07:6e:bc:2d:12:da:9b:04:c2:90

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 5, 2021 - Jun 10, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/final.ini

SHA256 8ae8385dcc63a47b0ea21bb971e2bfa463dd17f20966f61c8a77e080859f80bd
MD5 c2992df0c584a29b8fb2107d5697a730
SHA1 574c42ddbae37078ea1e1d1c1f66fc34e0fa795e
SHA512 b0968be63a9e43679c124e292acfaf1241bc48826ae1231690b9932ced4b8d5b429fc0c53484417b46b32e55f325e79d4d987963bf7313b3d1eeb3852df4ea66
TLSH
T112E0C28C8105123A8D3155865CEA6361B3C016389A422AB8F3A4048BC34F8D289DD9C7
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/options.ini

SHA256 f9fb88b64e7c8845fb2f4de82d18474b4aab1b49b03f4d79ea1d143dc0168d8a
MD5 825dc90c454ef29d15b3340fd9b5e691
SHA1 523d4f412e78f55f89145b4226df9bb08326bfae
SHA512 badade65b751b436aba6d0860ee839cdf68106ae008503e576f135efc31ff5dc15adff68e728a4ab8aabf7feec9d1ca7149e2fa365d0ceaeb09504853ca1464a
TLSH
T1042137CDA000D179DC30914638AB679677D12D346F0515B5FEB60843DB9DCE2CBAC2CA
MD5 SHA1 SHA512 TLSH

NPFInstall.exe

IMPHASH 27760b43b766b3f86ec66368fc404640
SHA256 f972c0cb631dfb53a27140c153ed0cdb9f177ba1515bb0f44c31ab0ef8386161
MD5 5915390eaa9f873fc8e2ef64aced6d79
SHA1 f785f0f1a40ce78d4aa748c30d2bf90b29d3d39d
SHA512 16def791ef7a80e48c5fc93742dfc9dd354774a5ecde66b008d8e7591d88e145f1f5a28fe92dd44028df5c23b52aa7ae2968084ff5f6f2586eb3958807f12292
SSDEEP 3072:EeAL76F10EE0nPlEaK76AthJWpOGzo9G5Wg9TNy5ifPaNbsNq+rY1p9r33utWoIT:676cENiexW2XnTNfrYxjetSUlqLZctmD
TLSH
T18E445A11BEE1C432F2B21D715D7586A65E3EBC602F3099CF538049BA9A71AD09B34B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

31:27:64:a2:c4:b6:e4:a3:db:d2:dc:07:46:85:9b:ad:96:70:0a:8b:2d:4e:51:9e:49:3d:33:76:dc:73:06:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 3, 2026

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

06:75:d6:b5:9e:f1:b0:ab:30:e5:d2:e0:46:da:24:31

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Jun 9, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

45824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\bonsa\source\repos\npcap\packetWin7\vs14\Release\NPFInstall.pdb

setupapi

CM_Get_Device_ID_ExW SetupDiGetDeviceInstallParamsW SetupDiGetClassDevsExW SetupDiClassGuidsFromNameExW SetupDiGetDeviceInfoListDetailW SetupDiCallClassInstaller SetupDiCreateDeviceInfoListExW SetupDiGetDeviceInstanceIdW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDevRegKeyW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupCopyOEMInfW

psapi

EnumProcessModulesEx GetModuleFileNameExW

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindFirstFileW SetLastError FindClose GetCurrentThreadId Sleep GetLastError GetLocalTime GetFullPathNameW GetModuleFileNameW GetFileAttributesW FormatMessageW DeleteFileW LoadLibraryW GetProcAddress LocalFree VerSetConditionMask FreeLibrary VerifyVersionInfoW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection ReadFile SetHandleInformation GetStringTypeW CreatePipe MultiByteToWideChar CloseHandle CreateProcessW GetConsoleWindow SetConsoleTitleW HeapFree GetCurrentProcess DeviceIoControl TerminateProcess WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetTickCount64 Process32NextW Process32FirstW HeapAlloc GetCurrentProcessId GetProcessHeap LCMapStringW CompareStringW VirtualProtect HeapSize HeapReAlloc GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW SetEndOfFile FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA WriteFile GetModuleHandleExW ExitProcess ReadConsoleW GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlUnwind EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

user32

CharNextW CharPrevW ShowWindow

advapi32

RegOpenKeyExW RegCloseKey OpenProcessToken RegGetValueW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitializeSecurity CoInitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

advpack

LaunchINFSectionExW

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer