extract an executable from a pcap