» NPBelv32.dll
Overview
Analysis
File Details
Behaviors (1)

NPBelv32.dll

BelMonitor Client

Belarc Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘BelNotify’.

File name:

NPBelv32.dll

Publisher:

Belarc, Inc. (signed by Belarc Inc)

Product:

BelMonitor Client

Description:

Belarc Advisor and BelMonitor Client Discovery

Version:

7.2c

MD5:

39c72cd6dfa23e76e5400ba09700ba26

SHA-1:

c0cd5d3a7b6fdc10cf31cf850bb79b52c7fdf0b6

SHA-256:

99d3f59846fb1274c6d565a38ade4bd323f03f9c147e1e71aea3b82b746ab75c

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/24/2024 8:38:41 AM UTC (today)

File size:

945.5 KB (968,184 bytes)

Product version:

7.2c

Trademarks:

Belarc, BelMonitor, BelManage, BelSecure, and Belarc Advisor are trademarks of Belarc, Inc.

Original file name:

NPBelv32.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\belarc\advisor\system\npbelv32.dll

Digital Signature

Signed by:

Belarc Inc

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

10/19/2005 8:52:07 AM

Valid to:

10/30/2006 12:44:26 PM

Subject:

CN=Belarc Inc, OU=Secure Application Development, O=Belarc Inc, L=Maynard, S=Massachusetts, C=US

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

401535

File PE Metadata

Compilation timestamp:

10/6/2006 9:44:49 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

7.10

CTPH (ssdeep):

12288:NtegN74FYbG/zAGkFlqljZG9iFUN1U7egxWO7jbYxlN378ys3nIgEz9:PNN7dbGZYEpZG9iA1UayrfbYbN+3y

Entry address:

0x776AF

Entry point:

6A, 0C, 68, 78, E0, 0A, 10, E8, C1, C8, FF, FF, 33, C0, 40, 89, 45, E4, 8B, 75, 0C, 33, FF, 3B, F7, 75, 0C, 39, 3D, F0, BB, 0C, 10, 0F, 84, B3, 00, 00, 00, 89, 7D, FC, 3B, F0, 74, 05, 83, FE, 02, 75, 31, A1, 28, 79, 0C, 10, 3B, C7, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D0, 89, 45, E4, 39, 7D, E4, 0F, 84, 85, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 22, FE, FF, FF, 89, 45, E4, 3B, C7, 74, 72, 8B, 5D, 10, 53, 56, FF, 75, 08, E8, B8, B3, FF, FF, 89, 45, E4, 83, FE, 01, 75, 0E, 3B, C7, 75, 0A, 53, 57, FF... 
[+]

Entropy:

6.4455

Developed / compiled with:

Microsoft Visual C++ v7.1

Code size:

632 KB (647,168 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

BelNotify

Command:

C:\Windows\System32\rundll32.exe C:\Program Files2\belarc\advisor\system\npbelv32.dll,rundll32_belnotify

Scan NPBelv32.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.