Should I block it?

No, this file is 100% safe to run.

Additional versions

6.1.7600.16385 (win7_rtm.090713-1255)	32.64%
6.1.7600.16385 (win7_rtm.090713-1255)	51.83%
6.1.7600.16385 (win7_rtm.090713-1255)	0.07%
6.0.6000.16386 (vista_rtm.061101-2205)	2.80%
6.0.6000.16386 (vista_rtm.061101-2205)	0.86%
6.0.6000.16386 (vista_rtm.061101-2205)	11.79%

Relationships

dfrgntfs.exe (Windows Disk Defragmenter by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

FreeSid, CheckTokenMembership, AllocateAndInitializeSid, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, RegSetValueExW, RegCreateKeyExW, DeregisterEventSource, ReportEventW, RegisterEventSourceW, SetSecurityDescriptorDacl, SetEntriesInAclW, InitializeSecurityDescriptor, GetSecurityDescriptorDacl, RegDeleteKeyValueW, CreateWellKnownSid, DuplicateToken, GetTokenInformation, OpenProcessToken, TraceMessage, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, ConvertStringSecurityDescriptorToSecurityDescriptorW, CloseTrace, StartTraceW, EnableTrace, ControlTraceW

kernel32.dll

GetLastError, GlobalLock, GlobalFree, GlobalReAlloc, GlobalUnlock, GlobalSize, GlobalAlloc, HeapFree, GetProcessHeap, HeapAlloc, SetLastError, InterlockedIncrement, InterlockedDecrement, EnterCriticalSection, LeaveCriticalSection, Sleep, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, CloseHandle, WriteFile, GetFileSize, CreateFileW, ReleaseMutex, FormatMessageW, GetCurrentThreadId, lstrlenW, GetTimeFormatW, GetDateFormatW, WaitForSingleObject, ExpandEnvironmentStringsW, LoadLibraryW, OutputDebugStringA, IsDebuggerPresent, SetFilePointer, GetLocalTime, WideCharToMultiByte, LocalFree, SetErrorMode, DeleteFileW, GetDiskFreeSpaceExW, GetTempFileNameW, GetVolumeInformationW, DeviceIoControl, GetDriveTypeW, GetConsoleOutputCP, WriteConsoleW, GetConsoleMode, GetFileType, GetStdHandle, VerifyVersionInfoW, VerSetConditionMask, GetCurrentProcess, ReleaseSemaphore, SetEvent, SetThreadUILanguage, CreateSemaphoreW, WaitForMultipleObjects, SetConsoleCtrlHandler, ResetEvent, CreateEventW, GetVolumePathNamesForVolumeNameW, GetVolumeNameForVolumeMountPointW, DuplicateHandle, OpenProcess, FreeLibrary, HeapSetInformation, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, InterlockedCompareExchange, InterlockedExchange, LoadLibraryExW, GetVolumePathNameW, MoveFileExW, FindFirstFileW, FindNextFileW, FindClose, CreateDirectoryW, GetFileAttributesW, InitializeCriticalSection, CreateThread, InterlockedPopEntrySList, InitializeSListHead, RtlCaptureStackBackTrace, InterlockedPushEntrySList, GetModuleHandleW

msvcrt.dll

DllMain

ntdll.dll

NtWaitForSingleObject, NtFsControlFile, NtQueryVolumeInformationFile, RtlAllocateHeap, RtlFreeHeap, EtwTraceMessage, RtlNtStatusToDosError, RtlGetLastNtStatus, RtlSetThreadErrorMode

ole32.dll

CoCreateInstanceEx, CoInitializeEx, CoRegisterClassObject, ReleaseStgMedium, CoCreateGuid, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, CoUninitialize, CoCreateInstance, CoDisconnectObject

sxshared.dll

SxTracerGetThreadContextRetail, SxTracerDebuggerBreak, SxTracerShouldTrackFailure

user32.dll

LoadStringW

virtdisk.dll

GetStorageDependencyInformation

defrag.exe

Windows Disk Defragmenter by Microsoft

Remove defrag.exe

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	fa9713d6409fd4ff58dd50f3f0e849af
SHA1:	d6ee08082b725134de2c288643e30f93271a4352
SHA256:	ddc3f05cd5d42dce8809dd12d68278bcc3745f60806b462a7026d40fc25d539a

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is defrag.exe?

Disk Defragmenter is a utility in Microsoft Windows designed to increase access speed by rearranging files stored on a disk to occupy contiguous storage locations, a technique called defragmentation. Defragmenting a disk minimizes head travel, which reduces the time it takes to read files from and write files to the disk. Beginning with Windows XP, Disk Defragmenter also reduces system startup times.

About defrag.exe (from Microsoft)

“Disk Defragmenter consolidates fragmented files and folders on your computer's hard disk, so that each occupies a single, contiguous space on the volume As a result, your system can gain access to y”

Details

File name:	defrag.exe
Publisher:	Microsoft Corp.
Product name:	Windows Disk Defragmenter
Description:	Disk Defragmenter Module
Typical file path:	C:\Windows\System32\defrag.exe
Original name:	Defrag.EXE.MUI
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	218.5 KB (223,744 bytes)
Digital DNA
PE subsystem:	Windows Console
Entropy:	7.282741
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Scheduled tasks

The task 'ManualDefrag' runs in the path '\Microsoft\Windows\Defrag\ManualDefrag'
The task 'ScheduledDefrag' runs weekly in the path '\Microsoft\Windows\Defrag\ScheduledDefrag'
Entry path '\Defragmentation'
Entry path '\Microsoft\Windows\Defrag\ManualDefrag'
Entry path '\Microsoft\Windows\Defrag\ScheduledDefrag'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.01295621%	0.028634%
Kernel CPU:	0.00646370%	0.013761%
User CPU:	0.00649251%	0.014873%
Kernel CPU time:	8,674 ms/min	100,923,805ms/min
Memory
Private memory:	1024 KB	21.59 MB
Private (maximum):	3.57 MB
Private (minimum):	3.48 MB
Non-paged memory:	1024 KB	21.59 MB
Virtual memory:	24.5 MB	140.96 MB
Virtual memory (peak):	27.5 MB	169.69 MB
Working set:	3.54 MB	18.61 MB
Working set (peak):	3.57 MB	37.95 MB
Resource allocations
Threads:	2	12
Handles:	70	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\defrag.exe -c -i
Owner:	SYSTEM
Parent process:	taskeng.exe (Task Scheduler Engine by Microsoft)

Threads