Should I block it?
No, this file is 100% safe to run.
PE file structure |
Show functions |
Import table
advapi32.dll
RegQueryValueExA, RegCloseKey, RegOpenKeyExA
kernel32.dll
FreeLibrary, lstrcatA, GetModuleFileNameA, ExitProcess, LoadLibraryA, GetProcAddress, lstrlenA
user32.dll
MessageBoxA
2e0a20.exe
MD5: | 9be063c792154d7a479cea3d7b5a2cd4 |
SHA1: | dd84afc595078c36bcd79b407600c51826b22f9b |
Overview
2e0a20.exe executes as a process with the local user's privileges. During installation, it (or a shortcut) is added to the user's startup folder which is designed to automatically launch when the user logs into Windows. This particular version is usually found on Microsoft Windows XP (5.1.2600.196608).
Details
File name: | 2e0a20.exe |
Typical file path: | C:\Windows\System32\3b2108\2e0a20.exe |
Size: | 111 KB (113,664 bytes) |
Digital DNA |
PE subsystem: | Windows GUI |
File packed: | No |
.NET CLR: | No |
More details
Behaviors
User start menu folder
Shortcut pointer placed in '%appdata%\Microsoft\Windows\Start Menu'
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
CPU |
Total CPU: | 0.01665015% | |
Kernel CPU: | 0.00562393% | |
User CPU: | 0.01102622% | |
Kernel CPU time: | 421,875 ms/min | |
Context switches: | 68/sec | |
Memory |
Private memory: | 13.6 MB | |
Private (maximum): | 19.06 MB | |
Private (minimum): | 15.54 MB | |
Non-paged memory: | 13.6 MB | |
Virtual memory: | 103.56 MB | |
Virtual memory (peak): | 111.69 MB | |
Working set: | 19.03 MB | |
Working set (peak): | 23.02 MB | |
Resource allocations |
Threads: | 3 | |
Handles: | 321 | |
GUI GDI count: | 83 | |
GUI USER count: | 38 | |
Process properties
Distribution by Windows OS
OS version | distribution |
Microsoft Windows XP |
100.00% |
|
Distribution by PC manufacturer
PC Manufacturer | distribution |
GIGABYTE |
100.00% |
|