A verification information creation system comprising: a determination section configured to determine whether a software to be verified is contained in an rpm package or a deb package; a first acquisition section, configured to install the software to be verified on an equipment, acquire an installation directory of the software from the equipment, identify a first file for which a first hash value is acquirable based on types of files stored in the acquired installation directory, and acquire a first file path and the first hash value of the first file for which the first hash value is acquirable if the determination section determines that the software to be verified is neither an rpm package nor a deb package; a first verification information creation section configured to create a first verification information used to verify the software, the first verification information including the first file path and the first hash value of the first file, the first file path and the first hash value being acquired by the first acquisition section; a second acquisition section configured to acquire a second file path and a second hash value of a second file to be checked using the second hash value during verification of the second file out of files contained in a software package of the software to be verified by executing a predetermined command for the software package if it is determined that the software to be verified is contained in an rpm package or a deb package; and a second verification information creation section configured to create a second verification information about the software package, the second verification information including the second file path and the second hash value of the second file, the second file path and the second hash value being acquired by the second acquisition section. a determination section configured to determine whether a software to be verified is contained in an rpm package or a deb package; a first acquisition section, configured to install the software to be verified on an equipment, acquire an installation directory of the software from the equipment, identify a first file for which a first hash value is acquirable based on types of files stored in the acquired installation directory, and acquire a first file path and the first hash value of the first file for which the first hash value is acquirable if the determination section determines that the software to be verified is neither an rpm package nor a deb package; a first verification information creation section configured to create a first verification information used to verify the software, the first verification information including the first file path and the first hash value of the first file, the first file path and the first hash value being acquired by the first acquisition section; a second acquisition section configured to acquire a second file path and a second hash value of a second file to be checked using the second hash value during verification of the second file out of files contained in a software package of the software to be verified by executing a predetermined command for the software package if it is determined that the software to be verified is contained in an rpm package or a deb package; and a second verification information creation section configured to create a second verification information about the software package, the second verification information including the second file path and the second hash value of the second file, the second file path and the second hash value being acquired by the second acquisition section.