| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2012-May-26 17:36:18 |
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | RsoP Services Application |
| FileVersion | 10.0.17763.3346 |
| InternalName | osopprov.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | osopprov.exe |
| ProductName | Microsoft® windows® Operating System |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Suspicious | The PE is possibly packed. | The PE only has 0 import(s). |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| MD5 | e010b9dc431fd4dd7105a9edf2004218 🔍 |
|---|---|
| SHA1 | c1b4d507c4c037b006a8632911fca3b1887dcb7a 🔍 |
| SHA256 | 8a5731386a0d2a903b718a86a824b65b3d89101dd7be9c257d3d4f50db5f5c58 🔍 |
| SHA3 | 9ee0e97ae5ad820eeddad0e218de6aaba30db2067de6ec409e8645a4bef94019 🔍 |
| SSDeep | 24576:9JCzK7X5YWctzbR7StUPrUkr/NX6N7DzlIQJLkjJgMS/llIGi01XF/pQq+5iO:cmzgZjUkr/N6NlpdM0C70tVpQf5i 🔍 |
| Imports Hash | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 2 |
| TimeDateStamp | 2012-May-26 17:36:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x136c00 |
| SizeOfInitializedData | 0x800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000000000 (Section: ?) |
| BaseOfCode | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x13c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 82a428c6d8c715e0920b0f5fbf521d89 🔍 |
|---|---|
| SHA1 | 644efe75f3759b66182c13b3d49da0cf6fc7d4b6 🔍 |
| SHA256 | f4e25f6553db75621b01628db9fe72a224cc37229921024879542fe76765c07f 🔍 |
| SHA3 | aa6c68724d2d94b2369b5bf3170d0c95fea4b364743f16f78804bdd859c81d4f 🔍 |
| VirtualSize | 0x136bac |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x136c00 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 7.98235 |
| MD5 | 0111e651f246ebc67356fa8eb639210c 🔍 |
|---|---|
| SHA1 | 0c7902dc35333fd8e658cd778eec6ccea45b6fb5 🔍 |
| SHA256 | 0057ce752a4d11d2b8aea7fa3f89198d9e2bf39d9aba4f906df5a40d4528b6c7 🔍 |
| SHA3 | f431a0753e0cea7686348290ca250e0309454a0c16265791c63d0f88375aa8df 🔍 |
| VirtualSize | 0x66e |
| VirtualAddress | 0x13a000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x136e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.5732 |
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x3e4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.35122 |
| MD5 | e4be020e548d3af848068b17fe530d2b 🔍 |
| SHA1 | e7d56a2ad272f055c752a8368fc04e2e7e245294 🔍 |
| SHA256 | 9f236dc1251a2d651eb0112278b6ee759b370e846fc6abe872389f771ede88ff 🔍 |
| SHA3 | 933fc3b5978d894cfadaf77d0015399577d6f41d02b7a040bb465e50516e8364 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | b7db84991f23a680df8e95af8946f9c9 🔍 |
| SHA1 | cac699787884fb993ced8d7dc47b7c522c7bc734 🔍 |
| SHA256 | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍 |
| SHA3 | 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | RsoP Services Application |
| FileVersion (#2) | 10.0.17763.3346 |
| InternalName | osopprov.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | osopprov.exe |
| ProductName | Microsoft® windows® Operating System |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
No comments yet.