Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-13 17:01:18 | 2025-06-13 17:32:47 | 1889 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,178 [root] INFO: Date set to: 20250613T10:31:16, timeout set to: 1800 2025-06-13 11:31:16,777 [root] DEBUG: Starting analyzer from: C:\tmp3bf0bupw 2025-06-13 11:31:16,777 [root] DEBUG: Storing results at: C:\uyHCokWh 2025-06-13 11:31:16,777 [root] DEBUG: Pipe server name: \\.\PIPE\IpEgLKC 2025-06-13 11:31:16,777 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-13 11:31:16,777 [root] INFO: analysis running as an admin 2025-06-13 11:31:16,777 [root] INFO: analysis package specified: "exe" 2025-06-13 11:31:16,777 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-13 11:31:17,199 [root] DEBUG: imported analysis package "exe" 2025-06-13 11:31:17,199 [root] DEBUG: initializing analysis package "exe"... 2025-06-13 11:31:17,199 [lib.common.common] INFO: wrapping 2025-06-13 11:31:17,199 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-13 11:31:17,199 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\Narrator.exe 2025-06-13 11:31:17,199 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-13 11:31:17,199 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-13 11:31:17,199 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-13 11:31:17,199 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-13 11:31:17,433 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-13 11:31:17,496 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-13 11:31:17,558 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-13 11:31:17,574 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-13 11:31:17,589 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-13 11:31:17,589 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-13 11:31:17,589 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-13 11:31:17,589 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-13 11:31:17,589 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-13 11:31:17,589 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-13 11:31:17,589 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-13 11:31:17,589 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-13 11:31:17,589 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-13 11:31:17,589 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-13 11:31:17,589 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-13 11:31:17,589 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-13 11:31:17,589 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-13 11:31:17,589 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-13 11:31:17,777 [modules.auxiliary.digisig] DEBUG: File is not signed 2025-06-13 11:31:17,777 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-13 11:31:17,777 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-13 11:31:17,777 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-13 11:31:17,792 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-13 11:31:17,792 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-13 11:31:17,792 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-13 11:31:17,792 [modules.auxiliary.disguise] INFO: Disguising GUID to 88063f41-cb09-49fe-8433-82e8a31757b9 2025-06-13 11:31:17,792 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-13 11:31:17,792 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-13 11:31:17,792 [root] DEBUG: attempting to configure 'Human' from data 2025-06-13 11:31:17,792 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-13 11:31:17,792 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-13 11:31:17,792 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-13 11:31:17,792 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-13 11:31:17,792 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-13 11:31:17,792 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-13 11:31:17,792 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-13 11:31:17,792 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-13 11:31:17,792 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-13 11:31:17,792 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-13 11:31:17,792 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-13 11:31:17,792 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-13 11:31:17,792 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-13 11:31:17,792 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-13 11:31:17,839 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp3bf0bupw\dll\696.ini 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-13 11:31:17,839 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-13 11:31:17,855 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp3bf0bupw\dll\pQxbIz.dll, loader C:\tmp3bf0bupw\bin\EPCPTrhb.exe 2025-06-13 11:31:17,902 [root] DEBUG: Loader: IAT patching disabled. 2025-06-13 11:31:17,918 [root] DEBUG: Loader: Injecting process 696 with C:\tmp3bf0bupw\dll\pQxbIz.dll. 2025-06-13 11:31:17,933 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-13 11:31:17,933 [root] INFO: Disabling sleep skipping. 2025-06-13 11:31:17,933 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-13 11:31:17,933 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-13 11:31:17,933 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-13 11:31:17,933 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-13 11:31:17,933 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-13 11:31:17,948 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-13 11:31:17,948 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-13 11:31:17,948 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-13 11:31:17,948 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8234D0000, thread 4456, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-13 11:31:17,948 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-13 11:31:17,964 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-13 11:31:17,964 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-13 11:31:17,964 [root] DEBUG: Successfully injected DLL C:\tmp3bf0bupw\dll\pQxbIz.dll. 2025-06-13 11:31:17,964 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-13 11:31:17,964 [root] DEB <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-13 17:01:18 | 2025-06-13 17:32:28 | none |
File Details
| File Name |
Narrator.exe
|
|---|---|
| File Type | PE32+ executable (GUI) x86-64, for MS Windows |
| File Size | 398848 bytes |
| MD5 | 214dccc90b289e067ec9916b0ec5569d |
| SHA1 | d8df12c4044688dc5862456d71d68e73dbbd02d2 |
| SHA256 | 746d9e5c6208a3854d4fb19fa3dfe691741a0a02b6e142916927749dcdbf4539 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 728768e188bc74b3340d12f4815e8ab36314ebac4dfa7febe414f266ebc1e6d67763b0cc1406352bb26ec82d512ad42b |
| CRC32 | C1C66D99 |
| TLSH | T118846C15E7980CD6E67BA13DD187C606F6B3B8014B2686CB1261831F6F7BAE4BD39311 |
| Ssdeep | 6144:Ekb6bhh+cjhJgIK9Ie+mkUauo/ykaNodL4zQFgZKUV:KhwcjhJR2IesyAuV |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
\$(D9{
<Element content="resstr(3031)" class="cp_content_text" layoutpos="top" padding="rect(0rp, 9rp, 0rp, 5rp)" shortcut="auto"/>
tN~Q(K
@.data
fD9)t
voicepitchslider
SelectObject
yyyyyyyy
KeyboardDialogCheckbox
=P1)vG
readhintscheckbox
caretwidth
ReleaseMutex
GetStartupInfoW
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z
APPID
_initterm_e
_o__itow_s
DeleteProcThreadAttributeList
EntryIndex
CoMarshalInterThreadInterfaceInStream
u`!L("
CreateSemaphoreExW
?SetID@Element@DirectUI@@QEAAJPEBG@Z
@A@T4
winenterlaunchenabled
?SetActive@Element@DirectUI@@QEAAJH@Z
#$9:p
E++E3
?GetTooltip@Element@DirectUI@@QEAA_NXZ
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
subentry
_o__purecall
_Mtx_init
EndDialog
<CCCheckBox id="atom(winenterlaunchenabled)" content="resstr(3106)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
<CCPushButton content="resstr(1603)" layoutpos="client" visible="true" id="atom(closebutton)" active="keyboard|mouse" font="CaptionFont;120%;Normal;None"/>
RegSetValueExW
<AccessibleButton AccName="resstr(3084)" id="atom(okbutton)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
D$$u1
L$HE3
ApplicationName
<Element layout="borderlayout()" visible="true" layoutpos="top" padding="rect(20rp, 10rp, 10rp, 5rp)">
</security>
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
<Element id="atom(PageGeneral)" visible="false" layout="borderlayout()" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)">
f9|$xt
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
N8D9i
?Release@RefcountBase@DirectUI@@QEAAJXZ
0A_A^A]A\_^[
u],,8
M!;m{
VWAVH
J)lllp
??1HWNDElement@DirectUI@@UEAA@XZ
<edit id="atom(SearchBox)" accname="resstr(1388)" class="Content" visible="true" accessible="true" accrole="text" active="keyboard|mouse" borderthickness="rect(0,0,0,0)" themedborder="true" height="28rp" layout="borderlayout()" layoutpos="top" margin="rect(12rp,5rp,12rp,5rp)" shortcut="83"/>
f94Gu
Microsoft Corporation
L!D$0
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
<Element class="MainPageButtonTitle" content="resstr(3077)" shortcut="auto"/>
LoadLibraryExW
fD9,Qu
D!t$$H
voicepitchlabelhigh
xnxT_~
<CCTrackBar id="atom(voicevolumeslider)" height="32rp" width="280rp" padding="rect(0rp, 0rp, 0rp, 2rp)" accessible="true" accrole="slider" accname="resstr(3042)"/>
pA_A^A]_^[]
AtlThunk_DataToCode
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
r\C-jq.
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?wP*q
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
@SUVWAVH
<Element class="MainPageButtonContent" content="resstr(3008)"/>
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
<CCCheckBox id="atom(couplekeyboardcheckbox)" content="resstr(3026)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
j@||B
<scrollviewer id="atom(listscrollviewer)" layoutpos="client" sheet="common" xscrollable="false" accname="Search list" accessible="true" accrole="list">
_initterm
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
fD9,Bu
_Thrd_join
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
InitThread
.idata$5
??0Combobox@DirectUI@@QEAA@XZ
<Element id="atom(PageVoice)" visible="false" layout="borderlayout()" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)">
CreateSolidBrush
D9D$X
.?AUhr_exception@@
%ws, %ws
couplemousecheckbox
yyyyyy
.pdata
internal\sdk\inc\wil\Resource.h
wcschr
<ComboBox id="atom(voicenamecombobox)" accname="resstr(3062)" padding="rect(5rp,0rp,0rp,0rp)" layoutpos="left" width="260rp"/>
Microsoft
a!Pbv
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z
NtQueryWnfStateData
v*caU
togglekeys
@UVWAVAWH
@8=i6
<CCPushButton id="atom(FindPreviousButton)" content="resstr(1390)" class="Content" visible="true" accessible="true" accrole="pushbutton" active="keyboard|mouse" width="200rp" layoutpos="left" shortcut="80"/>
.?AVCAtlException@ATL@@
A^A\_
DrawTextExW
CT$HH
.data$r$brc
9|$0H
GetMessageW
enduser\ezap\screenreader\exe\windowssapirenderadapter.cpp
_o__initialize_wide_environment
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z
=C|M,BG
_Cnd_do_broadcast_at_thread_exit
Software\Microsoft\Narrator
</scrollviewer>
fD94Bu
SetEvent
)qur987
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
Y_af4
L$XE3
_o__configthreadlocale
<element layout="borderlayout()" layoutpos="bottom">
0A^_^
SetDesktopColorTransform
Yg]KD
()*65:
ExitNarratorFromDialog
#$$9f
a7Z<i
colorfiltering
NlxLy(0
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
%hs!%p:
[T0 @X\\
K SVWH
_o___p__commode
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z
0A_A^A\_^
??1Combobox@DirectUI@@UEAA@XZ
:xZ+5N
OOBEInProgress
)3O.M
p WAVAWH
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
followinsertioncheckbox
ScreenMagnifier
D$(H!>L
<AHcA
voicespeedslider
P(`~~
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
.tls$ZZZ
WnwFr
CoCreateInstance
fD9u8
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
InitializeTouchInjection
<SearchListEntry layoutpos="top" accrole="listitem" accessible="true" accdefaction="click" foreground="buttontext" background="window" bordercolor="gtc(CONTROLPANELSTYLE,17,0,3821)" borderthickness="rect(1rp,1rp,1rp,1rp)" padding="rect(12rp,5rp,12rp,5rp)"/>
IPTip_Main_Window
L9{(u
GetFileAttributesW
HGFC;
<SearchList id="atom(listviewer)" layoutpos="client" sheet="s" layout="borderlayout()" accessible="true">
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
NarratorUIClass
api-ms-win-crt-string-l1-1-0.dll
LoCi,
.rdata$r
f9,Ku
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
$Yovr
.CRT$XIA
TerminateOnDesktopSwitch
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z
GetWindowRgn
UiaRaiseNotificationEvent
<stylesheets>
CreateFontW
DispatchMessageW
hA_A^A]A\_^][
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
<Element id="atom(PageHome)" layout="borderlayout()" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)">
Winlogon
<if class="cp_content_instruction">
?_C81
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
<CCPushButton content="resstr(3040)" layoutpos="right" id="atom(restoredefault)" active="keyboard|mouse"/>
ResetEvent
_o_wcscpy_s
h3"G'
x UAVAWH
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
_o__invalid_parameter_noinfo_noreturn
FileDescription
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
_o__ltow_s
keyboardpref
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
E\'^OhS
\$ VWAVH
CreateRectRgn
UWATAVAWH
PlaySoundW
/mlnp4
H;S v
<style resid="Narrator_style">
BeginPaint
ED$`H
hMx8i8
%0\.c
$$::@
ntdll.dll
D$HL+
voicevolumeslider
<CCPushButton content="resstr(3039)" layoutpos="left" id="atom(customizeshortcut)" active="keyboard|mouse"/>
10.0.17763.1
<element layout="borderlayout()" layoutpos="top" margin="rect(0, 5rp, 0, 0)">
WakeAllConditionVariable
InitializeCriticalSection
SetThreadPriority
SetWindowLongPtrW
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z
L$hE3
<Element foreground="buttontext" background="argb(0,0,0,0)" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)" font="gtf(CONTROLPANELSTYLE, 6, 0)" contentalign="wrapleft" accessible="true" accRole="statictext"/>
LDLlgw|
.?AV_com_error@@
GetForegroundWindow
H SVWH
(g3R?A
SetWindowLongW
<element layout="borderlayout()" layoutpos="top">
?Register@Combobox@DirectUI@@SAJXZ
JP"p>?s
OpenJobObjectW
CoWaitForMultipleHandles
P!PH)
<Element content="resstr(3014)" class="cp_content_text" layoutpos="top" padding="rect(0, 0, 0, 10rp)"/>
s3~\
D$(E3
fD9<Hu
C(H9{
fA9,Qu
ScreenRotated
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs
message
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
SetBrailleTablesFromReg
MapVirtualKeyExW
originatingContextName
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
Fdbnyv
0A_A^_^]
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
SearchBox
H!uHH
Attributes
userstandarderrorcheckbox
_o__wcslwr_s
okbutton
M++M#A
UWATH
L$(E3
H_^[]
memmove_s
cancelbutton
.rdata$zETW9
UVWAVAWH
L$0E3
_Thrd_start
9"i+[
<Element id="atom(PageTitle_General)" content="resstr(3072)" class="cp_content_instruction" layoutpos="top"/>
InflateRect
<Element foreground="highlighttext"/>
@2M3
UATAWH
A_A^A\_]
narrator
strrtt
</application>
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
Startup
TerminateProcess
\$ UVWAVAW
H!_8H
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
f9,Au
StretchBlt
InitializeConditionVariable
windowtrackingzorder
_o__seh_filter_exe
restoredefault
%s %s %s
Er~%F
NarratorElement::get_isInteresting failed
D$ H!u@H
enablecursorhighlightcheckbox
y}zz~v
*07`3s%:
CompareStringW
?DefaultAction@Element@DirectUI@@UEAAJXZ
?_Xout_of_range@std@@YAXPEBD@Z
PathRemoveFileSpecW
A_A^A]
GetUserObjectInformationW
Active
SUVWAVAWH
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
@A_A^A]A\_^[
mshelp://windows/?id=8e208950-1fd1-42b3-863b-261352113e3e
<if class="MainPageButtonTitle">
.CRT$XPZ
?333?
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z
</element>
.text$x
T$ E3
wDLDD|LV
enduser\ezap\screenreader\searchandselect\searchandselect.cpp
KillTimer
SetDlgItemTextW
IDATm
soX)tM
.xdata$x
FGHIJJ
8_@u+H
A_A^_H
h$gYN
dUUz!
GetModuleHandleW
DDDdG
SecureDesktopAccommodation
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
6k(Uca
PageNavigation
a2%L{
LB;+t{
L$ E3
.CRT$XLZ
System\Setup
_o__register_onexit_function
caretbrowsing
D$ht]L!D$@H
.giats
!t$(H!t$ E3
kernelbase.dll
41;;;
audiodescription
_o_wcscat_s
</if>
duckaudiocheckbox
StartList::SaveSessionKey
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
0A_A^_
ActivateActCtx
OriginalFilename
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
<Element id="atom(PageTitle_Navigation)" content="resstr(3073)" class="cp_content_instruction" layoutpos="top"/>
|{9'5 JK]qk
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
<Element font="gtf(CONTROLPANELSTYLE, 6, 0)" foreground="gtc(CONTROLPANELSTYLE,6,0,3803)" contentalign="wrapleft" accessible="true" accRole="statictext" padding="rect(10rp, 10rp, 10rp, 10rp)"/>
stickykeys
dDLLgw
P-b6%
: %CE'
fD94Au
|$(H;\$0
s3& m
<Element foreground="buttontext" background="argb(0,0,0,0)" layoutpos="top" padding="rect(10rp, 0, 0, 0)" font="CaptionFont;150%;Normal;None" contentalign="wrapleft" accessible="true" accRole="statictext"/>
CreateCompatibleBitmap
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">per monitor</dpiAware>
navigationmodecombobox
<CCSysLink id="atom(morevoices)" content="resstr(3049)"/>
wtDLF
?InvokePattern@Schema@DirectUI@@2HA
EnableWindow
RunNarrator
4M^aN
0nz,//D
L$`H;L$hs%H
<AccessibleButton AccName="resstr(3070)" id="atom(CommandsPage)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
UVWATAUAVAWH
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<Element content="resstr(3034)" class="cp_content_text" layoutpos="top" padding="rect(0rp, 9rp, 0rp, 5rp)" shortcut="auto"/>
CloseHandle
L$8E3
.?AVexception@std@@
Microsoft.EaseOfAccessCenter
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
@.reloc
bad array new length
<AccessibleButton AccName="resstr(3069)" id="atom(VoicePage)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
filterkeys
FreeSid
H98tLH
H9{ u}A
(9==;c
0A_A^A]_^
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
H!\$HH!\$PH
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
<Element layout="borderlayout()" layoutpos="top" padding="rect(0, 10rp, 0, 0)">
LoadResource
D9K(t
failureCount
GetSystemTimeAsFileTime
<if mousefocused="true">
CD$Pf
tQ;51Q
yP-M1is
?OnDestroy@Element@DirectUI@@UEAAXXZ
IsIconic
RegEnumValueW
?SetSelection@Combobox@DirectUI@@QEAAJH@Z
AtlThunk_InitData
<Element class="MainPageButtonTitle" content="resstr(3009)" shortcut="auto"/>
IDAT+
??0ElementProvider@DirectUI@@QEAA@XZ
<AccessibleButton AccName="resstr(3068)" id="atom(NavigationPage)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
<dependency>
UnregisterHotKey
|$HE3
gfffffffH+
?GetHeight@Element@DirectUI@@QEAAHXZ
f9<Hu
SetUnhandledExceptionFilter
RegLoadMUIStringW
wcscmp
8]j<k
??0HWNDElement@DirectUI@@QEAA@XZ
uS9\$@vM
.?AVtype_info@@
D$ E3
.text
UUaccc
fD9,Gu
DeactivateActCtx
ZZsK2
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
??1ElementProvider@DirectUI@@UEAA@XZ
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
\Narrator.lnk
yhj2U
<if class="cp_content_text">
.rdata$brc
SetWindowPos
pTV2o
originatingContextId
[ZZbQ5`
pA^_^
D9k@u'H
s WAVAWH
animations
SVWATAUAWH
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?GetSelection@Combobox@DirectUI@@QEAAHXZ
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
.idata$4
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
soundsentry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility
<assemblyIdentity
<CCTrackBar id="atom(voicespeedslider)" height="32rp" width="280rp" padding="rect(0rp, 0rp, 0rp, 2rp)" accessible="true" accrole="slider" accname="resstr(3041)"/>
.rdata$T$brc
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z
_Mtx_destroy
Search and select Object
`A_A^A]A\_^[
_o___stdio_common_vswprintf
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z
_o__cexit
OpenMutexW
RegEnumKeyExW
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
&7(-<
<CCPushButton id="atom(FindNextButton)" content="resstr(1389)" class="Content" visible="true" accessible="true" accrole="pushbutton" active="keyboard|mouse" width="200rp" layoutpos="right" selected="true" shortcut="78"/>
api-ms-win-core-com-l1-1-0.dll
overlappedcontent
fD91t
<Element class="MainPageButtonContent" content="resstr(3010)"/>
Software\Microsoft\Windows NT\CurrentVersion\AccessibilityTemp
HcD$ H
FVeLLd
__C_specific_handler
<Element contentalign="wrapleft" foreground="gtc(CONTROLPANELSTYLE,5,0,3803)" font="gtf(CONTROLPANELSTYLE, 5, 0)" accessible="true" accRole="statictext"/>
@USVWAVAWH
f9<Au
fF9,Ru
TraceMessage
0A_A^A]A\_^]
std::exception: %hs
minimumhitradius
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
(|$pA
WinSqmAddToStream
kkiheeecbaaX
fD90t
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
Fcy={Z
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ
CreateEventW
LoadLibraryExA
bad allocation
\On-Screen Keyboard.lnk
>s&N`2
DeleteObject
.text$mn$00
t$ WH
</windowsSettings>
FUU--
uwxv9
SetLastError
enduser\ezap\screenreader\searchandselect\sasui.cpp
Narrator-SearchAndSelect-ProgressUpdate
.rsrc$01
CallContext:[%hs]
DebugBreak
T*q)1
Y@H9;u%L
wcscspn
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
HT!M&
1!1'`
K32EnumProcessModules
Zckkk
<Element id="atom(voicespeedlabelslow)" content="resstr(3029)" class="cp_content_text"/>
ntelD
OLEACC.dll
B_lpd
CreateActCtxW
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
VirtualAlloc
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
_o__invalid_parameter_noinfo
GetWindowRect
InitializeSListHead
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
LIJ,&(
UnInitProcessPriv
fD99t
_CxxThrowException
EndPaint
IsWindow
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
<Element layout="borderlayout()" visible="true" layoutpos="top" padding="rect(0, 10rp, 0rp, 10rp)">
GetThreadDesktop
LeaveCriticalSection
_o__set_fmode
f9D$pu
??1ClassInfoBase@DirectUI@@UEAA@XZ
<Element class="MainPageButtonContent" content="resstr(3079)"/>
SearchListEntry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig
?SetMinSize@Element@DirectUI@@QEAAJHH@Z
K5LM^
"&y/9s
L$ SVWH
SetClipboardData
<description>Narrator</description>
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z
Microsoft Corporation. All rights reserved.
callContext
L$PH3
RegQueryValueW
<CCCheckBox id="atom(CaseSensitivityCheckBox)" content="resstr(1392)" class="Content" visible="true" accessible="true" accrole="checkbutton" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)" shortcut="67"/>
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ
L&sn@
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
.text$yd
IsWindowVisible
),?"4B=
zF@PP
GetWindowLongPtrW
(D$`A
u4L9u
AccNotifyTouchInteraction
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
IsProcessInJob
WATAVH
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
@USVWAUAVAWH
3y-~G
windowtracking
<if class="entry">
<SearchListEntry cursor="hand" foreground="highlighttext" background="highlight" font="CaptionFont;120%;Normal;None"/>
<Element class="cp_content_text" content="resstr(3037)" layoutpos="left" shortcut="auto"/>
ReleaseActCtx
@.rsrc
<Element id="atom(container)" background="window" layout="borderlayout()" layoutpos="client">
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
SetBrailleIsEnabledFromReg
l6[0M
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
api-ms-win-crt-private-l1-1-0.dll
MsgWaitForMultipleObjects
l$ E3
@A__^H
<Element layout="tablelayout(0,470,0,0,110,2,0,-90,1,0,110)" layoutpos="top" padding="rect(10rp, 10rp, 10rp, 9rp)">
<Element id="atom(voicevolumelabelloud)" content="resstr(3033)" class="cp_content_text"/>
%A0Q1a
LegalCopyright
w:]_7
TooltipAccessibleButton
CallWindowProcW
function
SendMessageTimeoutW
ATL$__a
}4D9`
<ComboBox id="atom(navigationmodecombobox)" accname="resstr(3061)" padding="rect(5rp,0rp,0rp,0rp)" layoutpos="left" width="120rp"/>
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
<style resid="s">
MonitorFromWindow
mainInstructionText
<dependentAssembly>
<if class="MainPageButtonContent">
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
morevoices
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z
cqq16
f9<Fu
</Element>
_o___std_exception_copy
eahh(
L$0H3
t^$zy8
H9Y`u)E3
FlushInstructionCache
<Element layout="borderlayout()" visible="true" layoutpos="top" padding="rect(20rp, 10rp, 10rp, 10rp)">
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\
<element layout="flowlayout(0,0,0,2)" layoutpos="top" padding="rect(0,10rp,0,10rp)">
??1Edit@DirectUI@@UEAA@XZ
_o__configure_wide_argv
HeapDestroy
fD9<Bu
V~>l?
.rdata$zzzdbg
LoadStringW
G;Yehhi
WAVAWH
AtlThunk_FreeData
.rdata
_Cnd_wait
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
9t$pH
!|$(H!|$ E3
4MNNQQP
??1NativeHWNDHost@DirectUI@@UEAA@XZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
wcsstr
;|$ s
fD9,Au
7mDyx
?Release@Value@DirectUI@@QEAAXXZ
StartList::CreateATProcess
WaitForSingleObject
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
<CCCheckBox id="atom(readhintscheckbox)" content="resstr(3100)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
</stylesheets>
enduser\ezap\screenreader\exe\windowsplatformadapter.cpp
??0ClassInfoBase@DirectUI@@QEAA@XZ
OpenProcessToken
RSDS3
GetModuleFileNameA
PageVoice
thfE9(tbH
PA_A^A\_^[]
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
SystemParametersInfoW
_o__set_app_type
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
SVWATAUAVAWH
MessageBoxW
SetBrailleCursorRepresentation
_register_thread_local_exe_atexit_callback
<element resid="main" layout="borderlayout()" layoutpos="client" sheet="s" accessible="true">
FindResourceExW
SearchList
CheckedStatus
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
voicevolumelabelquiet
memcpy
SetForegroundWindow
.idata$3
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
9TTUUVR
tttttt
?Register@Edit@DirectUI@@SAJXZ
_Mtx_destroy_in_situ
RtlDllShutdownInProgress
P\C2L
%s /start %s %s %s
string too long
tdLlL
EL(9o
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
|$HfD
C@:h5M.{
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z
ExpandEnvironmentStringsW
D9{@u'E
windowtrackingtimeout
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
<Element layoutpos="top" layout="flowlayout()">
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
(_^][
R*N4c
?Register@Element@DirectUI@@SAJXZ
fA9<Nu
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
UATAUAVAWH
(L$PA
HeapFree
invalid string position
0:^,4
currentContextId
=nK]]
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
KJM&*
6Sp t-
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
&9ZhB
$~PGs
L$@H3
PostMessageW
</SearchList>
<AccessibleButton AccName="resstr(3067)" id="atom(GeneralPage)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
??1RefcountBase@DirectUI@@UEAA@XZ
l2G!T
<Element class="MainPageButtonContent" content="resstr(3088)"/>
E/,@F
playaudiocuescheckbox
VoicePage
UWAVH
<CCCheckBox id="atom(lockkeyscheckbox)" content="resstr(3021)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
MultiByteToWideChar
echowordscheckbox
ATL$__m
E8nQH
<Element content="resstr(3012)" class="cp_content_text" layoutpos="top"/>
X?X2C
A_A^A\
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z
_o___stdio_common_vswprintf_s
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
@VWAVH
EventSetInformation
<SearchListEntry contentalign="wrapleft | focusrect" foreground="highlighttext" background="highlight" font="CaptionFont;120%;Normal;None"/>
(L$0A
0@(`s
9\$pH
_c_exit
_Mtx_init_in_situ
UWAUAVAWH
GetShellWindow
<Element id="atom(voicepitchlabelhigh)" content="resstr(3036)" class="cp_content_text"/>
eZ]]e
fE9$Fu
OutputDebugStringW
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?TossElement@ElementProvider@DirectUI@@UEAAXXZ
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z
,Narrator
@SVWAVAWH
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
ReturnHr
<Element id="atom(PageNavigation)" visible="false" layout="borderlayout()" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)">
_o__set_new_mode
not active
SHELL32.dll
<if class="subentry">
9\$Hu
helpbutton
<Element layout="borderlayout()" visible="true" layoutpos="top" padding="rect(20rp, 20rp, 10rp, 10rp)">
</dependency>
1lcIZJl
GetKeyboardLayout
D9{@u
@J,br
@A^_]
</duixml>
A^A\]
.CRT$XTA
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
<Element class="MainPageButtonContent" content="resstr(3098)"/>
9\$Pt
(D$ E
@8,1u
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
SetBrailleBlinkingCursor
CreateProcessW
$1025-
WATAUAVAWH
SettingConfiguration
.=a2#
ShellExecuteW
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
fD9t]
<CCCheckBox id="atom(interactmousecheckbox)" content="resstr(3022)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
Do)PN
A_A^A]A\_
|$ E3
.CRT$XCAA
CoGetInterfaceAndReleaseStream
\$ UH
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z
<AccessibleButton AccName="resstr(3097)" id="atom(helpbutton)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
<Element id="atom(voicespeedlabelfast)" content="resstr(3030)" class="cp_content_text"/>
ADVAPI32.dll
.CRT$XTZ
LQV=,,
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech\Voices
CreateThread
93@"z
L9{0t#H
.00cfg
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
DialogBoxParamW
@SUVWH
GetWindowTextW
gfffffffI
FailFast
fE9(t
pageNoVisual
enduser\ezap\screenreader\ui\mainwindow.cpp
=L%@= T
fD93t
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z
fD9<Cu
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ
xA_A]A\_^[
UVWATAVH
GetKeyState
ATAVAWH
InitProcessPriv
D$(H!\$ L
CompanyName
GetCurrentThreadId
D$ H!}8H
entry
'X]na
/hardwarebuttonlaunch
<Element content="resstr(3038)" class="cp_content_text" layoutpos="top" padding="rect(0, 0, 0, 10rp)" shortcut="auto"/>
StrToID
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z
Q==9955311
KKKX;p
name="Microsoft.Windows.Common-Controls"
@SVWATAUAVAWH
DDDDLFDe
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
_o__exit
GetProcessHeap
m+(8lln
6ssi_
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
Sleep
305.1i
L9oPu
ProcessIdToSessionId
interactmousecheckbox
D$ H!|$hH
GetTextExtentPoint32W
@A_A^A]A\_
GetFocus
GlobalFree
fD9*t
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z
u0HcH<H
t$ UWATAVAWH
t%A8vLu
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
M5jzH;
tOIcw
echokeystrokecheckbox
atlthunk.dll
GetCurrentActCtx
_o__errno
</AccessibleButton>
?DefaultAction@Button@DirectUI@@UEAAJXZ
UnInitThread
RegOpenKeyExW
<CCPushButton id="atom(CancelButton)" content="resstr(1391)" class="Content" visible="true" accessible="true" accrole="pushbutton" active="keyboard|mouse" width="200rp" layoutpos="right"/>
H9_Hs<
ReleaseSemaphore
DUI70.dll
ChangeWindowMessageFilterEx
SetBkColor
CreateEventExW
CopyRect
6vstyo
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
D){0p
PA_A^A]A\_^]
LockResource
T$8L+
+L$XD
GetObjectW
l$ VWAVH
Global\Windows.Machine.OOBE
*']_%!/ppmQM
?_Throw_Cpp_error@std@@YAXH@Z
version="6.0.0.0"
USVWAVH
A^_^][
_Mtx_lock
StartParams
SetWinEventHook
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
CurrentOrientation
L$ SUVWH
PA_A^_^[
PageGeneral
@8~8t
Fenduser\ezap\screenreader\exe\sr.cpp
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
CheckTokenMembership
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
wcsrchr
?_Xlength_error@std@@YAXPEBD@Z
focusborderheight
<i%9&
zI$K ]
_o__initialize_onexit_table
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ
_o_free
UATAVH
YYh*<H
688EEGHB^
D$PE3
D$$9D$(uxF
Screen Reader main window
highcontrast
t$HE3
<application xmlns="urn:schemas-microsoft-com:asm.v3">
memmove
<Element class="MainPageButtonTitle" content="resstr(3011)" shortcut="auto"/>
VVVhuu
(caller: %p)
fD94Fu
YVBYh
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
<CCCheckBox id="atom(echokeystrokecheckbox)" content="resstr(3016)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
@8y(t
OpenProcess
f94Bu
.rtc$TAA
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
0^/Hg
(null)
</trustInfo>
<CCCheckBox id="atom(playaudiocuescheckbox)" content="resstr(3050)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
type="win32"
N^|yf\U#
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
LoadIconW
??0RefcountBase@DirectUI@@QEAA@XZ
IDATx
<Element class="MainPageButtonContent" content="resstr(3082)"/>
040904B0
NarratorFindNativeHwndHost
]Web:}w:?.
.CRT$XIC
name="Microsoft-Windows-Narrator"
.rdata$zETW2
M H1E
M/+M'A
D9t$p@
SizeofResource
322/ihi
.0;!1
lockkeyscheckbox
ReleaseDC
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
(D$ A
.?AVbad_alloc@std@@
A_A^A]A\_^]
selectedFilter
>LS\?rpi
.rtc$IZZ
w<>`og@
A_A^]
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
"$ihb,
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
SHLWAPI.dll
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z
TranslateMessage
x)&0 f#
<requestedPrivileges>
^Y#da
<ComboBox transparent="true" accessible="true" font="gtf(CONTROLPANELSTYLE,14,0)"/>
<Element class="MainPageButtonTitle" content="resstr(3080)" shortcut="auto"/>
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z
fD94yu
?Register@HWNDElement@DirectUI@@SAJXZ
InitOnceComplete
magnifierpane
_Thrd_id
Hcl$0H
.rtc$IAA
*TZc4
fastkeyentrycheckbox
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
<CCCheckBox transparent="true" accessible="true" font="gtf(CONTROLPANELSTYLE,6,0)" foreground="gtc(CONTROLPANELSTYLE,6,0,3803)" background="themeable(dtb(CONTROLPANEL,2,0),window)"/>
RegQueryValueExW
@SVWH
VarFileInfo
VWAUAVAWH
R7dj"
PageHome
<Element layout="borderlayout()" layoutpos="top" padding="rect(0rp,10rp,0rp,0rp)">
JJLP||
mousekeys
<if class="Content">
fD9?t
<Element id="atom(PageTitle_Commands)" content="resstr(3075)" class="cp_content_instruction" layoutpos="top"/>
C H9{(u
WinSqmIsOptedIn
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ
<Element resid="main" layout="borderlayout()" sheet="Narrator_style" accessible="true" accrole="pane">
_o___stdio_common_vswscanf
VWAWH
mll8 2
$+D$x
?AddRef@RefcountBase@DirectUI@@QEAAJXZ
<CCCheckBox id="atom(followinsertioncheckbox)" content="resstr(3025)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
?SelectionItemPattern@Schema@DirectUI@@2HA
<requestedExecutionLevel level="asInvoker" uiAccess="true"/>
Configuration
pA^A]A\_^
_Cnd_init
D$@A;
Microsoft.Windows.Narrator.Asimov
`THtW
RegDeleteTreeW
D9t$p
3 LxJ".
<if pressed="true">
GlobalAlloc
|$@dt#D
AllocateAndInitializeSid
<4nz~
language="*" />
UIAutomationCore.DLL
Local\SM0:%d:%d:%hs
RegGetValueW
SUVWAVH
<CCCheckBox id="atom(enablecursorhighlightcheckbox)" content="resstr(3018)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
<Element id="atom(PageCommands)" visible="false" layout="borderlayout()" layoutpos="top" padding="rect(10rp, 0, 10rp, 0)">
L$PE3
##$#XX[Iy}
FormatMessageW
version="5.1.0.0"
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
module
D9kDu
windowarranging
InitializeCriticalSectionAndSpinCount
`c6s0
<security>
CoUninitialize
K32EnumProcesses
<!-- Copyright (c) Microsoft Corporation -->
|$ D+|$$A
A_A^A]A\_
.rtc$TZZ
10.0.17763.1 (WinBuild.160101.0800)
>z=n_
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
<Element id="atom(PageTitle_Voice)" content="resstr(3074)" class="cp_content_instruction" layoutpos="top"/>
focusborderwidth
DeleteCriticalSection
N.541
Software\Microsoft\Narrator\NoRoam
CopySettingsToLockedDesktop
RaiseException
GetWindowLongW
<element accessible="true" accrole="statictext" foreground="gtc(CONTROLPANELSTYLE,5,0,3803)" font="gtf(CONTROLPANELSTYLE, 5, 0)" layoutpos="top" contentalign="wrapleft"/>
WinlogonAccess
RtlCaptureContext
w$~!E
T$HH+
<CCSysLink transparent="true" accessible="true" font="gtf(CONTROLPANELSTYLE,6,0)" foreground="gtc(CONTROLPANELSTYLE,6,0,3803)" background="themeable(dtb(CONTROLPANEL,2,0), window)"/>
SilenceLength.SpeakSessionStart
d$8E3
<AccessibleButton AccName="resstr(3081)" id="atom(exitbutton)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
??0Element@DirectUI@@QEAA@XZ
x ATAVAWH
gfffffffH
.CRT$XLA
}0*PQ
(^!|#
D$@I;
CD$PE3
A_A^A]A\_H
4oB3>
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
UnhookWinEvent
Oo_eK
0A^_]
9\$0t
NavigationPage
GetWindowThreadProcessId
Oa,*~
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
HeapReAlloc
%ws%ws
??1AccessibleButton@DirectUI@@UEAA@XZ
HKEY_LOCAL_MACHINE
_Cnd_signal
t^@8=T6
A_A^_
<Element class="MainPageButtonTitle" content="resstr(3086)" shortcut="auto"/>
P 6s3i5&
RegisterHotKey
<Element content="resstr(3006)" layoutpos="top" width="522rp" id="atom(mainInstructionText)" active="keyboard" class="mainInstructionText"/>
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z
)WafffddZ
/'%tF
msvcp_win.dll
VirtualFree
A_A^A\
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\OOBE
<hY8`
DestroyWindow
MonitorFromPoint
D$0H;
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
processorArchitecture="*"
exitbutton
x AUAVAWH
@USVWATAVAWH
<element resid="main" layout="borderlayout()" layoutpos="client" sheet="NarratorFindStyle" accessible="true" accrole="pane" padding="rect(5rp, 5rp, 5rp, 5rp)">
InterlockedPopEntrySList
ExtTextOutW
IntersectRect
SVAVAWH
SetWindowTextW
<duixml>
&,6-777>d
DeleteDC
V/OO1
_o_terminate
YQPIbC
6D9{Dt
voicenamecombobox
L;t$P
D$T+D$\
VUUUA
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
startonlogonsyslink
??0Edit@DirectUI@@QEAA@XZ
KRzia\W\U$
RtlLookupFunctionEntry
H;Q(s
<Element class="MainPageButtonContent" content="resstr(3085)"/>
[%hs(%hs)]
B $.v
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
<CCPushButton transparent="true" accessible="true" minsize="size(76rp,23rp)" font="gtf(CONTROLPANELSTYLE,14,0)" margin="rect(6rp,0rp,0rp,0rp)"/>
QueryPerformanceCounter
</style>
BitBlt
<SearchBox id="atom(Search)" active="keyboard|mouse" absorbsshortcut="true" borderthickness="rect(0,0,0,0)" themedborder="true" height="28rp" accessible="true" accname="resstr(1601)" margin="rect(0rp,0rp,10rp,0rp)" font="CaptionFont;120%;Normal;None"/>
effffff
threadId
<element id="atom(SearchLabel)" content="resstr(1387)" class="Content" visible="true" accessible="true" accrole="statictext" layoutpos="top"/>
<AccessibleButton background="buttontext"/>
StringFileInfo
RegNotifyChangeKeyValue
t$ WAVAWH
scoping
0A_A^A]A\_
SR.exe
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ
NarratorCommandsListView
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
SetVoicePropertiesFromReg
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z
.text$mn
D$XE3
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\OOBE
L$(f#
failureId
GlobalUnlock
'ZjPJ
QW7Bw
<Element id="atom(container)" layout="borderlayout()" layoutpos="top">
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
.?AVbad_array_new_length@std@@
,$X}7
<Element id="atom(voicevolumelabelquiet)" content="resstr(3032)" class="cp_content_text"/>
LaunchSearchAndSelectStop
GetDCEx
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
@UWAVH
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
DecodePointer
!\$ 3
GetDlgCtrlID
EventWriteTransfer
42g8_+^
T$8H!t$8H
d2&c,f
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
h95up
voicespeedlabelfast
T$@E3
<Element class="MainPageButtonTitle" content="resstr(3013)" shortcut="auto"/>
voicespeedlabelslow
<CCTrackBar id="atom(voicepitchslider)" height="32rp" width="280rp" padding="rect(0rp, 0rp, 0rp, 2rp)" accessible="true" accrole="slider" accname="resstr(3043)"/>
9\$PH
L$`H3
dh Prd
VUUU+L$TA
_o_iswprint
D$@E3
O`9\$@
A8~QH
minimizebutton
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z
L$XH;
VendorPreferred
Narrator.pdb
A_A\]
?Click@Button@DirectUI@@SA?AVUID@@XZ
<AccessibleButton foreground="argb(0,0,0,0)" background="window" accessible="true" accrole="pushbutton" cursor="hand" contentalign="middleleft" height="66rp"/>
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z
GeneralPage
<Element class="MainPageButtonTitle" content="resstr(3083)" shortcut="auto"/>
GwLLxxxx
<element accrole="text" font="CaptionFont;120%;Normal;None" background="argb(0,0,0,0)" contentalign="wrapleft"/>
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ
8A^_^[
IsDebuggerPresent
.rdata$zETW1
_o_wcstok_s
:iDV}
bHXJK
UpdateNarratorSettingsFromReg
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
(D$@A
@A_A^A\
RtlVirtualUnwind
1SPd`"
_o__crt_atexit
GetModuleFileNameW
RaiseFailFastException
ATExe
StartMessagePump
cIAbH
StartList::Synchronize
SetTimer
f;L$h
w(L9>
name="SRH"
%s\ATConfig
F]]___aLb
.CRT$XCA
GetAsyncKeyState
KERNEL32.dll
'^eefgjjji
<CCCheckBox id="atom(couplemousecheckbox)" content="resstr(3024)" layoutpos="top" padding="rect(20rp, 5rp, 0rp, 5rp)"/>
??1DUIFactory@DirectUI@@QEAA@XZ
DDDDFLL
<AccessibleButton contentalign="middleleft | focusrect" background="highlight"/>
<windowsSettings>
??0AccessibleButton@DirectUI@@QEAA@XZ
T$8H!\$8
UnhandledExceptionFilter
BlockInput
HovUM'OC
DefWindowProcW
fD9 t
EventUnregister
currentContextName
#htAu
@SUVWATAUAVAWH
\Magnifier.lnk
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
_o___std_exception_destroy
<CCCheckBox id="atom(duckaudiocheckbox)" content="resstr(3105)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
hA_A^_^[]
VS_VERSION_INFO
<Element content="resstr(3010)" class="cp_content_text" layoutpos="top" padding="rect(0, 0, 0, 10rp)"/>
\$xH;
api-ms-win-core-synch-l1-2-0.dll
%SystemRoot%\System32\ATBroker.exe
A_A^_^]
<Element class="MainPageButtonTitle" content="resstr(3007)" shortcut="auto"/>
.CRT$XCZ
[UhG#
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
_o_towlower
\$(H;
LaunchUserOOBE
PostQuitMessage
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
7/-byy
map/set<T> too long
currentContextMessage
tCH;2u/H
Exception
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
<Element id="atom(voicepitchlabellow)" content="resstr(3035)" class="cp_content_text"/>
>hmmnoppqk
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z
`A^_^[]
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z
SendMessageW
j5LLL`rr
?Destroy@Element@DirectUI@@QEAAJ_N@Z
.CRT$XPA
9wHunH
.data
L$pH;
FindNextButton
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
OpenClipboard
?_Throw_C_error@std@@YAXH@Z
T$$D!t$ H
PathFileExistsW
SilenceLength.SpeakSessionEnd
L$8H;
memset
FillRgn
[%hs]
version="1.0.0.0" />
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
<Element overhang="false" background="argb(0,0,0,0)"/>
SetFocus
9A98u6A9x
R5g+C
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
\$ UVWAVAWH
GetProcAddress
ProductName
GetClassNameW
StartList::SaveSettings
??1Element@DirectUI@@UEAA@XZ
CreateCompatibleDC
PdjJ_{
4*Rq@Z
UUm>L'~
&K3Gs
Factory for ISearchAndSelect
.idata$6
D$`E3
D$8L+
_o_memcpy_s
GetParent
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
_o__wtoi
@A_A^_^]
m[3h4
D$HE3
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z
<if keyfocused="true">
ComboboxEx
PA^_^
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
_o_malloc
FileVersion
HeapSize
SystemSetting
<element background="themeable(dtb(CONTROLPANEL,2,0),window)"/>
L$hH3
i').6
SVWAVH
H9t$0u$H
CreateDialogParamW
SendNotifyMessageW
T$PH+
wilResult
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
<Element class="MainPageButtonTitle" content="resstr(3096)" shortcut="auto"/>
UAVAWH
A_A^_
_o_exit
k+uDEq$
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
</dependentAssembly>
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
StopMessagePump
<CCSysLink id="atom(startonlogonsyslink)" content="resstr(3019)" layoutpos="top" padding="rect(0rp,15rp,0rp,0rp)"/>
GetGUIThreadInfo
keyboardcues
0A_A^_^[
9|$PH
E9;53
Unknown exception
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
|$@H;
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
api-ms-win-crt-runtime-l1-1-0.dll
ExecuteNarratorFind
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
}1$_=C
Software\Microsoft\ColorFiltering
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z
<assemblyIdentity
__std_terminate
?@uqE
voicevolumelabelloud
6.]nqe
?Destroy@Layout@DirectUI@@QEAAXXZ
CoTaskMemAlloc
CreateMutexExW
MCCIJ\
L$XL+
H;\$0
U~r$!
EventRegister
tZM!C
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
<AccessibleButton AccName="resstr(3078)" id="atom(minimizebutton)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
GlobalLock
@UVWH
DeleteFileW
CoInitializeEx
GDI32.dll
SYSTEM\CurrentControlSet\Control\MiniNT
f9<Nu
GetProcessId
HeapAlloc
A_A^A\_^
PageCommands
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
GetComboBoxInfo
T$pE3
UIFILE
active
SVWAVAWH
@EDB7
<AccessibleButton AccName="resstr(3087)" id="atom(cancelbutton)" active="keyboard|mouse" layout="borderlayout()" layoutpos="top">
.data$brc
Description
L$pH3
Tz;F
OX0QY
<if class="mainInstructionText">
H3E H3E
InternalName
GetAncestor
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\colorfiltering
fE9,hu
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
SaS.dui
eR<ByV
WINMM.dll
IsProcessorFeaturePresent
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z
??0NativeHWNDHost@DirectUI@@QEAA@XZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
D$8H!\$0H
.rsrc$02
showsounds
<CCCheckBox id="atom(echowordscheckbox)" content="resstr(3046)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
GetDC
?GetX@Element@DirectUI@@QEAAHXZ
SetTextColor
t_o6v(>
RegisterApplicationRestart
D9D$XtFH
en-US
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
Orientation_PropertyChanged
T$@H;
OLEAUT32.dll
kernel32.dll
<Element layout="borderlayout()" layoutpos="bottom" padding="rect(10rp, 0rp, 10rp, 10rp)">
\$ VWATAUAVH
Microsoft.Windows.Settings.Accessibility
$9:=;M
<Element id="atom(PageTitle_Home)" content="resstr(3005)" class="cp_content_instruction" layoutpos="top"/>
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z
.text$di
b~~>f
<Element class="cp_content_text" content="resstr(3027)" layoutpos="left" shortcut="auto"/>
originatingContextMessage
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
VATAUAVAWH
<element font="CaptionFont;120%;Normal;None" contentalign="wrapleft"/>
VWATAVAWH
<Button accessible="true" contentalign="wrapleft"/>
CaseSensitivityCheckBox
UnregisterClassA
ColorFilter
GetCurrentProcessId
SetBrailleDeviceChangeFromReg
_o__wcsicmp
RegCreateKeyExW
<ComboBoxEx id="atom(scoping)" layoutpos="left" width="350rp" accessible="true" accname="resstr(1602)" sheet="common" font="CaptionFont;120%;Normal;None"/>
.rdata$zETW0
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ
K32GetModuleBaseNameW
RunningState
D$h;{
IDAT{
w|lLdldH
couplekeyboardcheckbox
0A^_^][
Qmm}&I
WaitForSingleObjectEx
9\$hwe9\$h
<Element class="MainPageButtonContent" content="resstr(3012)"/>
*_3Dy
GetSystemMetrics
L$HH=
<CCListView id="atom(NarratorCommandsListView)" layoutpos="top" borderstyle="Solid" bordercolor="windowtext" borderthickness="rect(1rp, 1rp, 1rp, 1rp)" height="200rp" accessible="true" accname="resstr(3058)"/>
Pz<C#
Screen Reader
dddLD
feKJ0
'Nm`s
@USWH
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z
@USVWH
CoTaskMemFree
CloseClipboard
GetDlgItem
PostThreadMessageW
processorArchitecture="amd64"
?SetX@Element@DirectUI@@QEAAJH@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
.CRT$XIZ
|$hH;
c{)& %;
?* T@
AccSetRunningUtilityState
InterlockedPushEntrySList
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z
EncodePointer
!This program cannot be run in DOS mode.
Msg:[%ws]
~`m}v<
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
FindPreviousButton
0t]*e
Lct$$H
A_A^A]A\_^[
CreateAndEnqueueNarratorCommandEvent
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ
Initialize
USER32.dll
5w fa
xwwwww
@8=*6
E8nPH
t"D8=
|$`H;
wcspbrk
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
D$ fD
??1AutoLock@DirectUI@@QEAA@XZ
L9{@u
OpenSemaphoreW
fC9<Fu
3hi-c
<Element content="resstr(3028)" class="cp_content_text" layoutpos="top" padding="rect(0rp, 9rp, 0rp, 5rp)" shortcut="auto"/>
M++,K0001
?Release@ElementProvider@DirectUI@@UEAAKXZ
CreateFontIndirectW
FallbackError
A_A^A]A\^
EnterCriticalSection
.CRT$XCU
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
\$ E3
-c\:Wfd
LoadImageW
<Element font="gtf(CONTROLPANELSTYLE, 6, 0)" foreground="gtc(CONTROLPANELSTYLE,6,0,3803)" contentalign="middleleft" accessible="true" accRole="statictext"/>
RegisterPointerDeviceNotifications
_o__get_wide_winmain_command_line
U+<=@;s
VVV0^X
tW9\$@D
,magnifierpane
Search
SendDlgItemMessageW
#enduser\ezap\screenreader\searchandselect\sasuiathread.cpp
ul0$y(
FullscreenCXHRunning
%hs(%d) tid(%x) %08X %ws
HKEY_CURRENT_USER
</requestedPrivileges>
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ
GetCurrentProcess
wcsspn
ONN^D
L9|$0t
??1CritSecLock@DirectUI@@QEAA@XZ
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
fileName
t]XbMN8r
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
<element content="resstr(1600)" layoutpos="left" class="Content"/>
D9t$pH
listviewer
fVCJb/
<fPg5
D$8E3
L9o@t
.?AVResultException@wil@@
`{{{-
*+-."
type="win32"/>
</assembly>
StartExe
/launchquickstart
7L;t$P
Translation
<CCCheckBox id="atom(userstandarderrorcheckbox)" content="resstr(3017)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
ATL$__z
FindWindowW
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\
fE9$Gu
ARGP@
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
<Element class="MainPageButtonContent" content="resstr(3014)"/>
|$0H!|$(3
WilError_02
messagetimeoutcombobox
SetStretchBltMode
_o__callnewh
SendInput
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
<Element contentalign="wrapleft | focusrect"/>
publicKeyToken="6595b64144ccf1df"
wcsncmp
222-[[Z
.CRT$XIAC
L$0H;
ProductVersion
E+#kev
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
__CxxFrameHandler3
ShowWindow
hD9t$p@
Y{uqQ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
`A_A^_^[
?AddRef@ElementProvider@DirectUI@@UEAAKXZ
vs(*P
.CRT$XIAA
@A_A^A\_^[]
,Bh]2
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z
A_A^A\_^[]
failureType
iaXcX
xwtDDDDLLlv
Windows
SleepConditionVariableCS
language
customizeshortcut
hresult
D$0E3
atomic=true
=L9o<
FilterType
.idata$2
CommandsPage
x AVH
.CRT$XCL
zB"r1
.tls$
fD94Cu
AtlThunk_AllocateData
<Element content="resstr(3008)" class="cp_content_text" layoutpos="top" padding="rect(0, 0, 0, 10rp)"/>
fB9<Fu
<element font="CaptionFont;120%;Normal;None" background="argb(0,0,0,0)" contentalign="wrapleft"/>
<CCCheckBox id="atom(fastkeyentrycheckbox)" content="resstr(3059)" layoutpos="top" padding="rect(0, 5rp, 0rp, 5rp)"/>
@VWATAVAWH
.H6&8
.xdata
UpdateProcThreadAttribute
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
.gfids
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
8A_A^^[
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z
InitializeProcThreadAttributeList
CancelButton
%hs(%d)\%hs!%p:
Operating System
?EndDefer@Element@DirectUI@@QEAAXK@Z
L>>]x
<CCCheckBox id="atom(mousemodecheckbox)" content="resstr(3053)" layoutpos="top" padding="rect(20rp, 5rp, 0rp, 5rp)"/>
vector<T> too long
B=Z@5^
GetModuleHandleExW
voicepitchlabellow
Lcd$PM
E'+E/
Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Session
SimpleProfile
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
xxwwww
@VWAWH
_o_calloc
<Element class="cp_content_text" content="resstr(3020)" layoutpos="left" shortcut="auto"/>
<AccessibleButton background="highlight"/>
NarratorSaSNativeHwndHost
GetMonitorInfoW
<if class="title">
vLEFjG6
FindUI.dui
+Tj{lkV#
t$ WATAUAVAWH
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
GetLastError
EventWrite
AuthD
LogHr
fffffff
EqualRect
mousemodecheckbox
Omn$AO
|$ UAVAWH
Profile
closebutton
enduser\ezap\screenreader\findui\findui.cpp
@A^A\_^]
HA_A^_^][
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
pb)Q'
messageduration
fD94Gu
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
RRzivm
3./..
<style resid="NarratorFindStyle">
?>@8__ajxy|
SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
<element layout="borderlayout()" layoutpos="top" margin="rect(12rp,5rp,12rp,5rp)">
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z
u"H!G@H
A_A^A]A\]
A_A^A]_]
?Register@AccessibleButton@DirectUI@@SAJXZ
InitOnceBeginInitialize
F5XBU
A8~PH
!"Atttttuuuq
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
kkhcXXXXXX
_o___stdio_common_vsnprintf_s
`.rdata
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
internal\sdk\inc\wil\ResultMacros.h
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
<ComboBox id="atom(messagetimeoutcombobox)" accname="resstr(3060)" padding="rect(5rp,0rp,0rp,0rp)" layoutpos="left" width="160rp"/>
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
RegCloseKey
_Cnd_destroy
Sxw-F
fAvMo
_Mtx_unlock
lineNumber
SRH.DLL
{UUC,?
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | PDB Path | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0x140000000 | 0x0002a690 | 0x00068e3c | 0x00068e3c | 10.0 | Narrator.pdb | 2003-04-17 01:03:48 | 441841651e6d47b310151f84ea85157f |  |
9f819b4f59ead248d32e6fdb38ed7089 | 0e432d63854dab2b57778096beebd090 | bc76fcc8c9d8f260 |
Version Infos
| CompanyName | Microsoft Corporation |
|---|---|
| FileDescription | Screen Reader |
| FileVersion | 10.0.17763.1 (WinBuild.160101.0800) |
| InternalName | SR.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | SR.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.17763.1 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x0002dae3 | 0x0002dc00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.22 |
| .rdata | 0x0002e000 | 0x0002f000 | 0x00015d8c | 0x00015e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.08 |
| .data | 0x00043e00 | 0x00045000 | 0x00001728 | 0x00000e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.77 |
| .pdata | 0x00044c00 | 0x00047000 | 0x00002394 | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.39 |
| .rsrc | 0x00047000 | 0x0004a000 | 0x00019b88 | 0x00019c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.16 |
| .reloc | 0x00060c00 | 0x00064000 | 0x000008a0 | 0x00000a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 5.15 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| MUI | 0x00063aa0 | 0x000000e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.71 | None |
| UIFILE | 0x00062978 | 0x000009dd | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.12 | None |
| UIFILE | 0x0005f428 | 0x0000354d | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.13 | None |
| UIFILE | 0x00063358 | 0x00000744 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.95 | None |
| RT_ICON | 0x0004a9a8 | 0x00000128 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.99 | None |
| RT_ICON | 0x0004aad0 | 0x00000568 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.93 | None |
| RT_ICON | 0x0004b038 | 0x000001e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.30 | None |
| RT_ICON | 0x0004b220 | 0x000006c8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.56 | None |
| RT_ICON | 0x0004b8e8 | 0x000002e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.51 | None |
| RT_ICON | 0x0004bbd0 | 0x000008a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.75 | None |
| RT_ICON | 0x0004c478 | 0x00000668 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.45 | None |
| RT_ICON | 0x0004cae0 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.79 | None |
| RT_ICON | 0x0004d988 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.54 | None |
| RT_ICON | 0x0004ddf0 | 0x00000988 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.55 | None |
| RT_ICON | 0x0004e778 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.89 | None |
| RT_ICON | 0x0004f820 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.08 | None |
| RT_ICON | 0x00051dc8 | 0x0000d223 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 7.97 | None |
| RT_GROUP_ICON | 0x0005eff0 | 0x000000bc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_VERSION | 0x0005f0b0 | 0x00000378 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.42 | None |
| RT_MANIFEST | 0x0004a480 | 0x00000528 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.97 | None |
Imports
| Name | Address |
|---|---|
| EventUnregister | 0x1400310a0 |
| EventRegister | 0x1400310a8 |
| EventSetInformation | 0x1400310b0 |
| RegCloseKey | 0x1400310b8 |
| RegCreateKeyExW | 0x1400310c0 |
| RegSetValueExW | 0x1400310c8 |
| EventWrite | 0x1400310d0 |
| RegOpenKeyExW | 0x1400310d8 |
| OpenProcessToken | 0x1400310e0 |
| AllocateAndInitializeSid | 0x1400310e8 |
| CheckTokenMembership | 0x1400310f0 |
| FreeSid | 0x1400310f8 |
| RegQueryValueExW | 0x140031100 |
| RegNotifyChangeKeyValue | 0x140031108 |
| RegEnumValueW | 0x140031110 |
| RegLoadMUIStringW | 0x140031118 |
| RegQueryValueW | 0x140031120 |
| TraceMessage | 0x140031128 |
| EventWriteTransfer | 0x140031130 |
| RegDeleteTreeW | 0x140031138 |
| RegEnumKeyExW | 0x140031140 |
| RegGetValueW | 0x140031148 |
| Name | Address |
|---|---|
| StretchBlt | 0x1400319d0 |
| SetStretchBltMode | 0x1400319d8 |
| BitBlt | 0x1400319e0 |
| CreateFontIndirectW | 0x1400319e8 |
| GetObjectW | 0x1400319f0 |
| CreateCompatibleBitmap | 0x1400319f8 |
| CreateCompatibleDC | 0x140031a00 |
| ExtTextOutW | 0x140031a08 |
| GetTextExtentPoint32W | 0x140031a10 |
| SetTextColor | 0x140031a18 |
| SetBkColor | 0x140031a20 |
| CreateFontW | 0x140031a28 |
| CreateSolidBrush | 0x140031a30 |
| SelectObject | 0x140031a38 |
| FillRgn | 0x140031a40 |
| CreateRectRgn | 0x140031a48 |
| DeleteObject | 0x140031a50 |
| DeleteDC | 0x140031a58 |
| Name | Address |
|---|---|
| _initterm | 0x1400322e8 |
| _initterm_e | 0x1400322f0 |
| _register_thread_local_exe_atexit_callback | 0x1400322f8 |
| _c_exit | 0x140032300 |
| Name | Address |
|---|---|
| UiaRaiseNotificationEvent | 0x140031e28 |
| Name | Address |
|---|---|
| PlaySoundW | 0x1400320f8 |
| Name | Address |
|---|---|
| NtQueryWnfStateData | 0x1400323e8 |
| WinSqmIsOptedIn | 0x1400323f0 |
| WinSqmAddToStream | 0x1400323f8 |
| RtlVirtualUnwind | 0x140032400 |
| RtlLookupFunctionEntry | 0x140032408 |
| RtlCaptureContext | 0x140032410 |
| Name | Address |
|---|---|
| AccSetRunningUtilityState | 0x140031d50 |
| AccNotifyTouchInteraction | 0x140031d58 |
| Name | Address |
|---|---|
| SysFreeString | 0x140031d68 |
| SysAllocString | 0x140031d70 |
| SysAllocStringLen | 0x140031d78 |
| SysStringLen | 0x140031d80 |
| VariantInit | 0x140031d88 |
| VariantClear | 0x140031d90 |
| SysAllocStringByteLen | 0x140031d98 |
| SysStringByteLen | 0x140031da0 |
| SafeArrayGetLBound | 0x140031da8 |
| SafeArrayGetUBound | 0x140031db0 |
| SafeArrayGetVartype | 0x140031db8 |
| SafeArrayLock | 0x140031dc0 |
| SafeArrayDestroy | 0x140031dc8 |
| SafeArrayUnlock | 0x140031dd0 |
| VarBstrCat | 0x140031dd8 |
| Name | Address |
|---|---|
| PathFileExistsW | 0x140031e10 |
| PathRemoveFileSpecW | 0x140031e18 |
| Name | Address |
|---|---|
| ShellExecuteW | 0x140031de8 |
| Name | Address |
|---|---|
| CoTaskMemFree | 0x140032108 |
| CoGetInterfaceAndReleaseStream | 0x140032110 |
| CoCreateInstance | 0x140032118 |
| CoInitializeEx | 0x140032120 |
| CoUninitialize | 0x140032128 |
| CoWaitForMultipleHandles | 0x140032130 |
| CoTaskMemAlloc | 0x140032138 |
| CoMarshalInterThreadInterfaceInStream | 0x140032140 |
| Name | Address |
|---|---|
| _Cnd_wait | 0x140032350 |
| _Mtx_unlock | 0x140032358 |
| ?_Throw_C_error@std@@YAXH@Z | 0x140032360 |
| _Mtx_lock | 0x140032368 |
| _Mtx_destroy_in_situ | 0x140032370 |
| _Mtx_init_in_situ | 0x140032378 |
| ?_Xout_of_range@std@@YAXPEBD@Z | 0x140032380 |
| ?_Xlength_error@std@@YAXPEBD@Z | 0x140032388 |
| _Cnd_init | 0x140032390 |
| _Mtx_init | 0x140032398 |
| _Cnd_do_broadcast_at_thread_exit | 0x1400323a0 |
| _Cnd_destroy | 0x1400323a8 |
| _Mtx_destroy | 0x1400323b0 |
| _Thrd_start | 0x1400323b8 |
| _Thrd_join | 0x1400323c0 |
| _Thrd_id | 0x1400323c8 |
| _Cnd_signal | 0x1400323d0 |
| ?_Throw_Cpp_error@std@@YAXH@Z | 0x1400323d8 |
Usage
Processing ( 0.64 seconds )
- 0.63 CAPE
- 0.007 AnalysisInfo
- 0.001 Debug
Signatures ( 0.06 seconds )
- 0.009 antianalysis_detectfile
- 0.008 ransomware_files
- 0.005 antiav_detectreg
- 0.005 ransomware_extensions
- 0.003 ursnif_behavior
- 0.002 antiav_detectfile
- 0.002 infostealer_ftp
- 0.002 infostealer_im
- 0.002 poullight_files
- 0.002 territorial_disputes_sigs
- 0.001 banker_zeus_p2p
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 antianalysis_detectreg
- 0.001 antivm_vbox_files
- 0.001 antivm_vbox_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 infostealer_bitcoin
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 infostealer_mail
- 0.001 masquerade_process_name
- 0.001 revil_mutexes
- 0.001 modirat_behavior
Reporting ( 0.00 seconds )
- 0.002 CAPASummary
- 0.001 JsonDump
Signatures
The PE file contains a PDB path
pdbpath: Narrator.pdb
The binary likely contains encrypted or compressed data
section: {'name': '.rsrc', 'raw_address': '0x00047000', 'virtual_address': '0x0004a000', 'virtual_size': '0x00019b88', 'size_of_data': '0x00019c00', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x40000040', 'entropy': '7.16'}
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.