» btmshell.dll
Overview
Analysis
File Details
Behaviors (1)

btmshell.dll

Motorola Bluetooth

Motorola Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘BTMTrayAgent’.

File name:

btmshell.dll

Publisher:

Motorola, Inc. (signed by Motorola Inc)

Product:

Motorola Bluetooth

Description:

Bluetooth Shell Extension

Version:

3,0,2,285

MD5:

cfe8f097669fddadfd87c74956f0113a

SHA-1:

0804f9d6c982704187851e7d2546b42e3abe4082

SHA-256:

eb125b75c70203de52d7ffc5e98cb158afe338a8271cbe5018d483b4942211a5

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/30/2024 2:04:25 PM UTC (today)

File size:

20.7 MB (21,705,296 bytes)

Product version:

3,0,2,285

Original file name:

btmshell.dll

File type:

Dynamic link library (Win64 DLL)

Common path:

C:\Program Files\motorola\bluetooth\btmshell.dll

Digital Signature

Signed by:

Motorola Inc

Authority:

VeriSign, Inc.

Valid from:

10/8/2010 9:00:00 AM

Valid to:

10/12/2011 8:59:59 AM

Subject:

CN=Motorola Inc, OU=BSC IPS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Motorola Inc, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

1A191B3F645D6A4880FC212BD3E9BEBF

Registration

CLSIDs:

{05EC7A45-AB9A-4e9f-83D9-1DBD055649B1}, {0A7D34C2-E9DA-48A1-9E34-0CDFC2DE3B44}, {0D92F3FA-02A3-485e-A3BB-E94FEF29D45F}, {15F7A019-417A-4067-A2A9-D3B50D2DF8F2}, {2A8BBFB0-2ADC-4DDC-BCBB-F694A6192904}, {2A8BBFB0-2ADC-4DDC-BCBB-F694A6192905}

ProgIDs:

BTMShell.BTFTPQueryInfo.1, BTMShell.SendToContextMenu.1, BTMShell.BTServiceFolder.1, BTMShell.BTDeviceExtractIcon.1, BTMShell.BTBackupClient.1, BTMShell.BTPBAPClient.1, BTMShell.BTFTPContextMenu.1, BTMShell.BTFTPExtractIcon.1, BTMShell.BTFTPClient.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

11/22/2010 11:29:26 PM

OS version:

4.0

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

8.0

Entry address:

0x13F590

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 83, FA, 01, 49, 8B, F8, 8B, DA, 48, 8B, F1, 75, 05, E8, 8F, 6B, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 83, FE, FF, FF, CC, CC, CC, E9, 6B, 1A, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 48, 89, 5C, 24, 08, 57, 48, 83, EC, 20, 48, 8D, 05, 07, 0F, A3, 00, 8B, DA, 48, 8B, F9, 48, 89, 01, E8, 02, 6C, 00, 00, F6, C3, 01, 74, 08, 48, 8B, CF, E8, C5, FF, FF, FF, 48, 8B, C7, 48, 8B... 
[+]

Entropy:

6.3618

Code size:

1.4 MB (1,417,216 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

BTMTrayAgent

Command:

rundll32.exe "C:\Program Files\motorola\bluetooth\btmshell.dll",trayapp

Scan btmshell.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.