CmdID / Files

libwireshark.dll

Wireshark dissector library file version info

Library on Windows 1 known copy with hashes

Is it the real libwireshark.dll?

file version info and known copies

Installed inC:\Program Files\Wireshark\

Signed byWireshark Foundation

ProductWireshark, The Wireshark developer community, https://www.wireshark.org/

DescriptionWireshark dissector library

1 known copy

3.2.7 · C:\Program Files\Wireshark\libwireshark.dll · signed by Wireshark Foundation

78e5278751583ad6f327a0e7fdf789c2692f71768b035ceac0266857f6f6b642

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.