682b57e1c05ef375931975c9d6ded40888f4bfdf9f4b11571e654f962f1199b6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-19 20:38:47
Detected languages English - United States
FileDescription Npcap 1.90 installer
FileVersion 1.90
LegalCopyright Copyright (c) 2025, Nmap Software LLC. All rights reserved.
ProductName Npcap
ProductVersion 1.90

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: Nmap Software LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/71 (Scanned on 2026-10-31 21:19:08) All the AVs think this file is safe.

Hashes

MD5 f930c0fe5c0a7b3cf178b9a0298a3915 🔍
SHA1 3dc5ed5922fb0b9bd32b926d82f8e0dcf6219689 🔍
SHA256 682b57e1c05ef375931975c9d6ded40888f4bfdf9f4b11571e654f962f1199b6 🔍
SHA3 cb858a28713fe12640e059cf15eba451296c6d898a82367d50313dd608efa25e 🔍
SSDeep 24576:PVhSI6cgjKCFL1dCeiUjNiEk2K0pYN7So3nTBxMgmyVwIKfPBPjDtHb2vtt4V7r:zSs2KqRIei8NRQFSo3ntyyVwp3BPN722 🔍
Imports Hash 9b5ef063ac31ccf7d26131466e9e89e5 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-Apr-19 20:38:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x7000
SizeOfInitializedData 0x24c00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x00003B14 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x53000
SizeOfHeaders 0x400
Checksum 0x14fa31
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ddd2adc242b7964e854c9a21d7c393b4 🔍
SHA1 e1bb2755ab3dc76c92a70737f6a4b02900bf190c 🔍
SHA256 bf381574aa815e5c3222b124917df6748cd32fdd77744e361df8c437ab18810e 🔍
SHA3 8bd066baadea07fb3b78767b80faeaa73515643e1c9d2840a1b9e3a57ae6f8ff 🔍
VirtualSize 0x6f14
VirtualAddress 0x1000
SizeOfRawData 0x7000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44387

.rdata

MD5 526127c1d4048941af8134336fcea354 🔍
SHA1 5b7fb2156a8a281fc821ce1e0cc77a2aa8f1c619 🔍
SHA256 faa1c58c1d6d1d02b34cd170e1dc959de3dbd45cc36d69c26d774207f5106272 🔍
SHA3 da82f59bf9e8cba238478617125c9ce40b53d36eca0e51173146f4d2e319c05d 🔍
VirtualSize 0x13ac
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.17052

.data

MD5 60ed175bfcf4514145d0a827a2fe38d6 🔍
SHA1 d8b5ba0d15874e835a65bda0229bbf4f42ae1a73 🔍
SHA256 4a0330c2e88f27bdbd4d9879b210e1b19a2149245211996dd23bfb781cfd9086 🔍
SHA3 1e28f6eeaf1f5ca38ba08549af26cecc8aace29ec4dddf361672022401e78f30 🔍
VirtualSize 0x22518
VirtualAddress 0xa000
SizeOfRawData 0x1800
PointerToRawData 0x8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.59815

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x21000
VirtualAddress 0x2d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 9f02a7554902aa95d6e0afb1e2773f3a 🔍
SHA1 6b7f9d0718d1303d1dd06921f5feaaee3c2f0dfc 🔍
SHA256 36885db3a273600d906c1b2f0f3c291937bde5ea867bed8c8fad6ce24234da32 🔍
SHA3 019eab0aeba890739e9a486409b9892a3f2f459cc7a77c1aac6da13f6f6b5ecf 🔍
VirtualSize 0x4490
VirtualAddress 0x4e000
SizeOfRawData 0x4600
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.89412

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
IsDlgButtonChecked
GetAsyncKeyState
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
CharNextA
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
PeekMessageW
DispatchMessageW
wvsprintfW
SystemParametersInfoW
wsprintfA
CreatePopupMenu
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
GetLastError
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.26612
MD5 0ec0a0948a526b9c7eebe39bb02b6b0b 🔍
SHA1 867b304f20fd74abeb5c30515837f1c41cd3bf8f 🔍
SHA256 d442adb90ba296c7e617d2f58d6fa6f308bcd8ef65e5e9c66db4dd27f93fcfbe 🔍
SHA3 5bc458755a2ca5c7475620389d9b6b67952973c4366c6777d45c969b8bc67cd4 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.9993
MD5 6b224e01af48ec8e4c17a59d9534e885 🔍
SHA1 de787d2a1e840618ba2c7eb69d28f6966c404d1d 🔍
SHA256 50279c9885b490e74b49ac0273940b6e0891b62fc9ffb5c52e35422a694f248b 🔍
SHA3 71b543301bccda64ba61a27873c952890233e0cbec10e0b59245fc303bcfadbc 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24459
MD5 ca82d899b1d402941b5c92ed9028cd95 🔍
SHA1 fb329ec4455d5caf1753305debcc14ab6ebb9015 🔍
SHA256 9da1013c864092e49c2676b3ba68a0d4513457d77d251730ed73cc5f4a4813b1 🔍
SHA3 768277223731ffdcb799e50961d0afccf23bbae54118d53b834617ccbd0c5cd9 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01502
MD5 05e60fd47096a729dda2aaa4ab05ebc7 🔍
SHA1 de8ec9b484fa4f565b14f55503c9cd95231b633b 🔍
SHA256 61f762babde9942f43ee97154b8734efeed0632a6ea778dc395793ae3e3e7507 🔍
SHA3 f8ba0d4a91389414904cc66226099f27f482055e90ba449e2396193f139713d8 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.16057
MD5 d9ee3a2962251a241bce41b0524cfc0e 🔍
SHA1 2ba919aaa7237367a158e4b95385ab1ee07643d8 🔍
SHA256 69e6579a37fcaec037634e7fecbfc6a26093ea81dc4bd555d8a12187d2cd0866 🔍
SHA3 a1699668464f7edf9a748dfc264f9d30e3c69a228be0a18cade30c14aa6c77ba 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34146
MD5 53482d364aa2d4ae7ca05199dad7651a 🔍
SHA1 ccb213408acc7f5ddb94753e6410be23aab5cedd 🔍
SHA256 ff06189b43a5c1d6cc5d1b7cbf6ab56b1157ec52807945d652274a211462cba5 🔍
SHA3 60659e39ef3f267c267093f8bc4c87ed61eea4ef96ac0f583184f580844573e5 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04232
MD5 636ad42555a835e3a94209043df4a45a 🔍
SHA1 c878613bda5cba6cb5769846e60229890c5df248 🔍
SHA256 491e52ded039ec6684277e6f1f820e288763ae6d20e682bcfffb6cee4518ac23 🔍
SHA3 4b79e60727e0f7be7495c59fb949e22bd753cff6e145e4694257a21a7b5dba8c 🔍

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 a69caf66f3f899403f8b25b02dc61908 🔍
SHA1 3e5db9186cf0f75be24676462d88170e5950d9c8 🔍
SHA256 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50 🔍
SHA3 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67385
MD5 d1a92272fbd597e1aa19021483110d5a 🔍
SHA1 9f75072682b37c6c52361d8c988ebd06dd003f63 🔍
SHA256 15663576584c947d634dab9848defcc7d8f05eb0b7e7c6d52d81eca695fc7a6e 🔍
SHA3 704756797695ae34f6fae500852bca70e5066a1d1993348fe40ccf626235d0d6 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f 🔍
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673 🔍
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6691
Detected Filetype Icon file
MD5 e624f041c921d299a6da3a8c5f48f989 🔍
SHA1 ffa07c86ac3dac45398ee07b26610dfb5c99d8ea 🔍
SHA256 fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584 🔍
SHA3 b51d47dbe9cbe18b1f520275504256022a827f919672b081943ae45cd4ff44c9 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x258
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40528
MD5 c1e667f655b3062e1e1d275adf5d2a94 🔍
SHA1 10a041fc14dd1c4e45a772d9f4b3daa7dba1d3c2 🔍
SHA256 d847eea7c436bdefc8edafd8d1fc174e5657418d2aff1c417927107e68c20684 🔍
SHA3 8a0ab6155ae96b2e45a7429e19ee29d47a5cd0e5b1196b88fcdf9b2801bc67eb 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28856
MD5 1fd71e32fefe479992624888d25fe9ae 🔍
SHA1 10f4fe542b92415245577e3704e88f36a88cc885 🔍
SHA256 e0334b84b86b2d01c23d241ffb3bdf643ab16812c9ba353abcccc00f89c744b1 🔍
SHA3 af0d5e0e11cc7ebe43684bcf418c3f5275cd7ad562e59bdf7636111040f9ea17 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 5.1.90.1020
ProductVersion 5.1.90.1020
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Npcap 1.90 installer
FileVersion (#2) 1.90
LegalCopyright Copyright (c) 2025, Nmap Software LLC. All rights reserved.
ProductName Npcap
ProductVersion (#2) 1.90
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd28650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 166
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.