Should I block it?
No, this file is 100% safe to run.
 PE file structure
|
Show functions |
Import table
advapi32.dll
RegQueryValueExA, RegCloseKey, RegOpenKeyExA
kernel32.dll
FreeLibrary, lstrcatA, GetModuleFileNameA, ExitProcess, LoadLibraryA, GetProcAddress, lstrlenA
user32.dll
MessageBoxA
2e0a20.exe
| MD5: | 9be063c792154d7a479cea3d7b5a2cd4 |
| SHA1: | dd84afc595078c36bcd79b407600c51826b22f9b |
Overview
2e0a20.exe executes as a process with the local user's privileges. During installation, it (or a shortcut) is added to the user's startup folder which is designed to automatically launch when the user logs into Windows. This particular version is usually found on Microsoft Windows XP (5.1.2600.196608).
Details
| File name: | 2e0a20.exe |
| Typical file path: | C:\Windows\System32\3b2108\2e0a20.exe |
| Size: | 111 KB (113,664 bytes) |
| Digital DNA |
| PE subsystem: | Windows GUI |
| File packed: | No |
| .NET CLR: | No |
More details
Behaviors
User start menu folder
Shortcut pointer placed in '%appdata%\Microsoft\Windows\Start Menu'
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.01665015% | |
| Kernel CPU: | 0.00562393% | |
| User CPU: | 0.01102622% | |
| Kernel CPU time: | 421,875 ms/min | |
| Context switches: | 68/sec | |
| Memory |
| Private memory: | 13.6 MB | |
| Private (maximum): | 19.06 MB | |
| Private (minimum): | 15.54 MB | |
| Non-paged memory: | 13.6 MB | |
| Virtual memory: | 103.56 MB | |
| Virtual memory (peak): | 111.69 MB | |
| Working set: | 19.03 MB | |
| Working set (peak): | 23.02 MB | |
| Resource allocations |
| Threads: | 3 | |
| Handles: | 321 | |
| GUI GDI count: | 83 | |
| GUI USER count: | 38 | |
Process properties
Distribution by Windows OS
| OS version | distribution |
| Microsoft Windows XP |
100.00% |
|
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| GIGABYTE |
100.00% |
|
