Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.07%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.07%
6.2.9200.16384 (win8_rtm.120725-1247)	0.14%
6.2.9200.16384 (win8_rtm.120725-1247)	0.07%
6.1.7600.16385 (win7_rtm.090713-1255)	0.34%
15.0.4454.1000	0.96%
15.0.4433.1506	0.07%
15.0.4420.1017	1.65%
15.0.4420.1017	1.45%
15.0.4128.1022	1.24%
15.0.4128.1019	0.07%
15.0.4128.1014	0.62%
15.0.4128.1014	0.21%
14.0.4730.1010	38.50%
14.0.4730.1010	3.58%
12.0.6413.1000	0.21%
12.0.4518.1014	40.50%
11.0.5525	10.26%

Relationships

atbroker.exe (Windows Assistive Technology Manager by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

RegEnumValueW, CryptReleaseContext, CryptAcquireContextW, SetFileSecurityW, RegDeleteKeyW, OpenThreadToken, CheckTokenMembership, ConvertStringSecurityDescriptorToSecurityDescriptorW, LookupAccountNameW, AllocateAndInitializeSid, FreeSid, CryptHashData, CryptGetHashParam, CryptCreateHash, CryptDestroyHash, RegisterServiceCtrlHandlerW, RegCloseKey, RegEnumKeyExW, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, SetThreadToken, RegQueryValueExW, RegNotifyChangeKeyValue, SetServiceStatus, StartServiceCtrlDispatcherW, DuplicateToken, RegDeleteValueW

kernel32.dll

FormatMessageA, GetComputerNameW, GetModuleHandleA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, HeapAlloc, GetProcessHeap, HeapReAlloc, HeapFree, HeapSize, RaiseException, LoadLibraryA, MoveFileExW, GetLastError, GetModuleFileNameW, CloseHandle, SetEvent, InterlockedIncrement, InterlockedDecrement, lstrlenW, GetDriveTypeW, GetLogicalDrives, lstrcmpW, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, Sleep, ExitProcess, InitializeCriticalSection, GetCommandLineW, GetTickCount, ReleaseMutex, ResetEvent, WaitForMultipleObjectsEx, SetErrorMode, CreateEventW, CreateMutexW, CreateProcessW, GetSystemInfo, InterlockedExchange, CreateFileA, ReadFile, SetFilePointer, DosDateTimeToFileTime, MultiByteToWideChar, FreeLibrary, GetProcAddress, LoadLibraryW, WideCharToMultiByte, CreateFileW, ReleaseSemaphore, WaitForSingleObject, WaitForMultipleObjects, CreateThread, CreateSemaphoreW, VirtualFree, VirtualAlloc, SetFilePointerEx, GetSystemTimeAsFileTime, SystemTimeToFileTime, GetSystemTime, SetFileTime, SetEndOfFile, WriteFile, GlobalFree, GlobalAlloc, GetFileAttributesExW, GetFileSizeEx, FindClose, FindFirstFileW, GetFileAttributesW, CopyFileW, CreateHardLinkW, SetFileAttributesW, DeleteFileW, GetTempPathA, GetTempPathW, GetFileTime, FindNextFileW, LocalFree, GetCurrentThread, CreateDirectoryW, RemoveDirectoryW, lstrlenA, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, LocalAlloc

msvcrt.dll

DllMain

rpcrt4.dll

RpcImpersonateClient, RpcRevertToSelf, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, NdrServerCall2

ose.exe

Office Source Engine by Microsoft Corporation (Signed)

Remove ose.exe

Version:	6.3.9600.16384 (winblue_rtm.130821-1623)
MD5:	7b6fb28d49cf73f6f170fac7fe38bf8a
SHA1:	63827e4c1c98ceacf02756564f5bef32395ccaa7

Overview

ose.exe runs as a service under the name Office Source Engine (ose) within the local user context. It is installed with a couple of know programs including DeviceManager published by eInstruction and DeviceManager published by eInstruction. The file is digitally signed by Microsoft Corporation. and is compiled as a 64 bit program.

Details

File name:	ose.exe
Publisher:	Microsoft Corporation
Product name:	Office Source Engine
Typical file path:	C:\Program Files\common files\microsoft shared\source engine\ose.exe
File version:	6.3.9600.16384 (winblue_rtm.130821-1623)
Product version:	6.3.9600.16384
Size:	807.5 KB (826,880 bytes)
Build date:	8/22/2013 11:32 AM
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Effective date:	Monday, December 7, 2009
Expiration date:	Monday, March 7, 2011
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.564145
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Programs

The following programs will install this file

DeviceManager

eInstruction

5% remove

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'ose' (Office Source Engine)
'ose64' (Office 64 Source Engine)
ose64
'ose'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00052283%	0.028634%
Kernel CPU:	0.00049136%	0.013761%
User CPU:	0.00003147%	0.014873%
Kernel CPU time:	6,484 ms/min	100,923,805ms/min
CPU cycles:	688,432/sec	17,470,203/sec
Context switches:	17/sec	284/sec
Memory
Private memory:	5.33 MB	21.59 MB
Private (maximum):	16.92 MB
Private (minimum):	15 MB
Non-paged memory:	5.33 MB	21.59 MB
Virtual memory:	117.77 MB	140.96 MB
Virtual memory (peak):	122.81 MB	169.69 MB
Working set:	16.91 MB	18.61 MB
Working set (peak):	16.93 MB	37.95 MB
Page faults:	31,087/min	2,039/min
I/O
I/O read transfer:	936 Bytes/sec	1.02 MB/min
I/O read operations:	45/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	401 Bytes/sec	448.09 KB/min
I/O other operations:	7/sec	1,671/min
Resource allocations
Threads:	14	12
Handles:	302	600
GUI GDI count:	60	103
GUI GDI peak:	73	142
GUI USER count:	39	49
GUI USER peak:	45	71

Process properties

Integrety level:	High
Platform:	64-bit
Command line:	"C:\Windows\System32\osk.exe"
Owner:	User
Windows Service
Service name:	ose
Display name:	Office Source Engine
Description:	“Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports.”
Type:	Win32OwnProcess
Parent process:	atbroker.exe (Windows Assistive Technology Manager by Microsoft)

Threads