CmdID / Files

libwiretap.dll

Wireshark capture file library file version info

Library on Windows 1 known copy with hashes

Is it the real libwiretap.dll?

file version info and known copies

Installed inC:\Program Files\Wireshark\

Signed byWireshark Foundation

ProductWireshark, The Wireshark developer community, https://www.wireshark.org/

DescriptionWireshark capture file library

1 known copy

3.2.7 · C:\Program Files\Wireshark\libwiretap.dll · signed by Wireshark Foundation

d68ba56ff61ff8b1cf23c033a38ac5bfff70eecd78e06aefdc22f765eabdba6a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.