Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-12 06:36:05 | 2025-06-12 07:06:50 | 1845 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,506 [root] INFO: Date set to: 20250611T17:06:29, timeout set to: 1800 2025-06-11 18:06:29,412 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-11 18:06:29,412 [root] DEBUG: Storing results at: C:\gHzlKZ 2025-06-11 18:06:29,412 [root] DEBUG: Pipe server name: \\.\PIPE\rHrtLqJID 2025-06-11 18:06:29,412 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-11 18:06:29,412 [root] INFO: analysis running as an admin 2025-06-11 18:06:29,412 [root] INFO: analysis package specified: "exe" 2025-06-11 18:06:29,412 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-11 18:06:30,162 [root] DEBUG: imported analysis package "exe" 2025-06-11 18:06:30,162 [root] DEBUG: initializing analysis package "exe"... 2025-06-11 18:06:30,162 [lib.common.common] INFO: wrapping 2025-06-11 18:06:30,162 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-11 18:06:30,162 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\WindowsInternal.Comp.exe 2025-06-11 18:06:30,162 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-11 18:06:30,162 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-11 18:06:30,162 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-11 18:06:30,162 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-11 18:06:30,349 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-11 18:06:30,443 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-11 18:06:30,474 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-11 18:06:30,474 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-11 18:06:30,489 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-11 18:06:30,489 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-11 18:06:30,489 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-11 18:06:30,505 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-11 18:06:30,505 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-11 18:06:30,505 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-11 18:06:30,505 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-11 18:06:30,505 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-11 18:06:30,505 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-11 18:06:30,505 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-11 18:06:30,505 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-11 18:06:30,505 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-11 18:06:30,505 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-11 18:06:30,505 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-11 18:06:30,662 [modules.auxiliary.digisig] DEBUG: File is not signed 2025-06-11 18:06:30,662 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-11 18:06:30,662 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-11 18:06:30,662 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-11 18:06:30,662 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-11 18:06:30,662 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-11 18:06:30,662 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-11 18:06:30,662 [modules.auxiliary.disguise] INFO: Disguising GUID to 0cc594cc-feba-4a5b-a55d-bf6cf6b2e84f 2025-06-11 18:06:30,662 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-11 18:06:30,662 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-11 18:06:30,662 [root] DEBUG: attempting to configure 'Human' from data 2025-06-11 18:06:30,662 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-11 18:06:30,662 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-11 18:06:30,662 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-11 18:06:30,677 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-11 18:06:30,677 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-11 18:06:30,677 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-11 18:06:30,677 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-11 18:06:30,677 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-11 18:06:30,677 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-11 18:06:30,677 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-11 18:06:30,677 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-11 18:06:30,677 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-11 18:06:30,677 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-11 18:06:30,677 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-11 18:06:30,709 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-11 18:06:30,709 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-11 18:06:30,724 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\yOjggjR.dll, loader C:\tmp_gell1p8\bin\xkGaAUPF.exe 2025-06-11 18:06:30,771 [root] DEBUG: Loader: IAT patching disabled. 2025-06-11 18:06:30,771 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\yOjggjR.dll. 2025-06-11 18:06:30,786 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-11 18:06:30,786 [root] INFO: Disabling sleep skipping. 2025-06-11 18:06:30,786 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-11 18:06:30,786 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-11 18:06:30,786 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-11 18:06:30,786 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-11 18:06:30,786 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-11 18:06:30,802 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-11 18:06:30,833 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-11 18:06:30,833 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-11 18:06:30,833 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8247E0000, thread 4624, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-11 18:06:30,833 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-11 18:06:30,849 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-11 18:06:30,849 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-11 18:06:30,849 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\yOjggjR.dll. 2025-06-11 18:06:30,849 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-11 18:06:30 <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-12 06:36:05 | 2025-06-12 07:06:30 | none |
File Details
| File Name |
WindowsInternal.Comp.exe
|
|---|---|
| File Type | PE32+ executable (GUI) x86-64, for MS Windows |
| File Size | 956416 bytes |
| MD5 | 45a949e52c9730bbe5cf50936bb5c75c |
| SHA1 | 6409730a5ccc8dbac17d7cbb79cd4daf5f3fc75c |
| SHA256 | f1e7e298c28441180a0fdf04b870fae5e00e0796925e3211e5df35616814c4ef [VT] [MWDB] [Bazaar] |
| SHA3-384 | d616c064d30fdc3f9d1eba57df9f4f55848913013b4067b70bea433919a924088d4f392f4dee38c19869d2ec0b56acba |
| CRC32 | 8867CA88 |
| TLSH | T15D152A162B9C45D0D979917889B29786FA71B8610F11C7CB5472932E2F7B0F0AE3E732 |
| Ssdeep | 12288:FOsIPVj+3w7hVDJSxrVF4YyJmP47pAzQsLPxpyHj7:Q73DJ4RF4YyJmgFA5xpsj7 |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
CurrentState
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
LayoutGrid
^1?]8
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.ITextFrameworkAdapter, Object>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarItem
@.data
InputAppSuspending
Windows.Foundation.Collections.IVectorView`1<WindowsInternal.ComposableShell.Experiences.TextInput.InputSwitcherLanguageProfile>
WindowsCreateStringReference
??1_Locinfo@std@@QEAA@XZ
KeyboardSettingsMenuPanel
ReleaseMutex
GetStartupInfoW
PA^_^][
L;D$ t
Alpha
_initterm_e
Select
CandidateFontFamily
IsModalOverlayShown
_Count
Dictation hotkey hide
CreateSemaphoreExW
CameraSettings
@SVWAVH
Windows.UI.Xaml.Visibility
Windows.Foundation.Collections.IVector`1<WindowsInternal.ComposableShell.Experiences.TextInput.KeyboardSettingsMenuProfile>
t;I;7u'L
H90u2H
ContactPanel
_o__purecall
D9d$P}7L
ItemType
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
ExpandButton
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationStyles
D8d$X
KatakanaHalfWidth
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
AutomationNameInPersonalization
WindowsInternal.ComposableShell.Experiences.TextInput.KeyboardSettingsMenuViewModel
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
qV[H=
KeyBubble
FlyoutInputMode_HalfWidthAlphaNumeric
TelephoneAreaCode
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarItemType
InputPanelShowRequestRejected
Protocol
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.ITextInputSettingsManager, WindowsInternal.ComposableShell.Experiences.TextInput.ITextInputSettingsValueChangedEventArgs>
api-ms-win-core-string-l1-1-0.dll
System.Enum
VWAVH
D;k }*E
RegistryKeysToListen
PA_A^A]A\_^[
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.TextInputAudioManager
L$xH3
InputPanelPageViewStateChanged
Microsoft Corporation
InputAppActivated
fD9,Qu
memcmp
Punctuation
.u$H;3
C D8U
D8extKL
InputPanelShowAnimationCompleted
WindowsInternal.ComposableShell.Experiences.TextInput.InputLocaleManagerDataSource
`A^_^][
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
gH9QPtv8QLu.H
RoReportUnhandledError
@SUVWAVH
ContentType
HandwritingCombinedRecognition
Windows.Storage.Streams.IRandomAccessStream
d:\os\src\shellcommon\composable\components\textinput\hostapp\toolbarcontrolpage.xaml.cpp
delayedMsec
.?AU__I?$Array@PE$AAVString@Platform@@$00PublicNonVirtuals@Platform@@
.?AUIWeakReferenceSource@Details@Platform@@
.data$r
NoCloudCandidate
_initterm
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItemInfoType
.idata$5
ActiveProfileIndex
Windows.Foundation.Collections.IVectorView`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ICandidateItem>
.CRT$XIYA
L$ H;L$(t
originName
Windows.Foundation.Uri
Config
.pdata
Microsoft
SetRestrictedErrorInfo
ActiveLayoutPositionProfile
NtQueryWnfStateData
ItemContentString
WindowsInternal.ComposableShell.Experiences.TextInput.TextFrameworkFactory
SmartFuzzyCandidate
UnitKeyWidthInPixels
)f=76
t#E9V0t
Appx Shell Input Application
\$H@2
.CRT$XIYB
8A_A^A]A\_^][
Windows.Foundation.Metadata.ApiInformation
WindowsInternal.ComposableShell.Experiences.TextInput.ITextFrameworkAdapter
AddressCity
ActivityFailure
L$0H;L$8t%
NativeScript
Function
.PE$AAVFailureException@Platform@@
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarItemID
_o__configthreadlocale
Toggled
XamlTypeInfo.InfoProvider.XamlTypeInfoProvider
KanaInputMode
0A^_^
CL$@H
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.CandidateControlPage
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IInputPanelModel, Object>
_o_wcstol
Windows.Foundation.IReference`1<Int32>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarItemType
%hs!%p:
.PE$AAVInvalidArgumentException@Platform@@
ComponentControl
K SVWH
Windows.Foundation.IReference`1<Double>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.PasteControl
_o___p__commode
FlyoutSetting_SendFeedback
|$$A;E$
PasswordNumeric
FlyoutKanaMode_KanaModeOff
CoCreateFreeThreadedMarshaler
s(L;s0
p WAVAWH
InkStrokeIds
\$@H+\$8H
WalletAction
ControlKey
ActivityStoppedAutomatically
.?AU__I?$WriteOnlyArray@PE$AAVString@Platform@@$00PublicNonVirtuals@Platform@@
DateDayName
IsGlyphDisplayString
L$ H;L$(t/D9I
IsSettingsLauncherAvailable
ShareTarget
WindowsInternal.ComposableShell.Experiences.TextInput.TextInputCandidateItemFlag
??0ChangedStateException@Platform@@QE$AAA@XZ
.PE$AAUIDisposable@Platform@@
WindowsInternal.ComposableShell.Experiences.TextInput.SettingsManager
D9w u
9\u=H
eventType
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
Windows.Foundation.IReference`1<Windows.UI.Xaml.Visibility>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.KeyBubbleControl
api-ms-win-crt-string-l1-1-0.dll
DateYear
WilStaging_02
.rdata$r
f9,Ku
`A^_^
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItemInfoType>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.TextInputResourceLoader
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.InputPanelPage
D9d$P}=L
.CRT$XIA
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationMicrophoneButton
Alternates
InputMode
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IDictationModel
api-ms-win-core-rtlsupport-l1-1-0.dll
AutomationNameInFlyoutMenu
IsMFUGroup
hA_A^A]A\_^][
LargestTrigger
IsPositionSettingsAvailable
ms-appx://InputApp/DictationControlPage.xaml
?id@?$ctype@_W@std@@2V0locale@2@A
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
\$ VWATAVAWH
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarItemType>
x UAVAWH
E`D+EXD
_o__invalid_parameter_noinfo_noreturn
FileDescription
\$ UVWH
ModeProfileItems
LabelType
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputGroupLabelType>
\$ VWAVH
UWATAVAWH
.PE$AAVNullReferenceException@Platform@@
RtlSubscribeWnfStateChangeNotification
ED$`H
InputAppPage_OnLoaded
ntdll.dll
PickSaveFileContinuation
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarItemID>
InitializeCriticalSection
A_A^A\_^
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarItemType>
Windows.UI.Xaml.Controls.ListViewItem
d:\os\public\amd64fre\internal\sdk\inc\wil\staging.h
D$P@8p
Initialized
IsAvailable
Boolean
10.0.17763.292 (WinBuild.160101.0800)
System.ValueType
ms-inputapp
ExpressiveInputItemInstance
InputPanelPageSettingsValueChanged
D$(E3
fD9<Hu
fA9,Qu
HangulFullWidth
message
originatingContextName
0A_A^_^]
<P)9Y
.PE$AAVChangedStateException@Platform@@
\$HL;
arguments
upper
GetTickCount64
UWATH
RinnaCandidate
Message: %ws
.rdata$zETW9
UVWAVAWH
L$0E3
DateMonth
L$8H3
D$ H+
WindowsInternal.ComposableShell.Experiences.TextInput.InputSwitcherLanguageProfile
??0OutOfBoundsException@Platform@@QE$AAA@XZ
GroupName
A_A^A\_]
CandidateControlPage
H;L$(u
vector<bool> too long
DllCanUnloadNow
FontSizeOverride
RoOriginateError
SV7R!-Hc4
TerminateProcess
\$ UVWAVAW
OutputCharSet
minATL$__m
f9,Au
Windows.Foundation.Rect
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IKeyActionHandler
KeyboardShortcutFontOverride
_o__seh_filter_exe
Object
\$ A;
Selected
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputCompactListViewItem
?_Xout_of_range@std@@YAXPEBD@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.inputapp_XamlTypeInfo.__XamlMetaDataProviderActivationFactory
FilePickerExperience
Windows.Foundation.IReference`1<Windows.Foundation.Rect>
.CRT$XPZ
CategoryGroupIndex
PA_A^A\_^
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
.text$x
E90tA
PlainText
Extension
T$ E3
$0< u=3
SIP_Handwriting
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IXamlKeyboardGrid
SIP_Full
blank
.xdata$x
L$HH3
A^_^
GetModuleHandleW
H;D$8u
PrintTaskSettings
HandwritingRecognition
_o__register_onexit_function
kernelbase.dll
?Free@Heap@Details@Platform@@SAXPEAX@Z
(D$Pf
??0NullReferenceException@Platform@@QE$AAA@XZ
FlyoutDictionaryTool_UserDictionary
Shell requested hide
HorizontalOffset
A_A^A\_^][
api-ms-win-core-winrt-error-l1-1-0.dll
KeyboardSet.Common
OriginalFilename
.?AU__abi_Module@@
api-ms-win-core-interlocked-l1-1-0.dll
Double
L$HH;
.?AU__abi_IUnknown@@
CloudPending
WindowsInternal.ComposableShell.Experiences.TextInput.TextInputEditBufferFactory
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
wnH9O
L$0fD
fD94Au
Emoji_Kaomoji
ProcessPendingEvent
\$8E3
D9yL|
AlphaLatinEmoji
ItemIconFontFamily
UVWATAUAVAWH
KeyboardGrid
NtUpdateWnfStateData
CloseHandle
L$8E3
ItemId
.?AVexception@std@@
PersonalFullName
@.reloc
bad array new length
EmailUserName
{|?uXH
VerticalOffset
WindowsInternal.ComposableShell.Experiences.TextInput.KeyboardSettingsMenuProfile
??1_Lockit@std@@QEAA@XZ
9\uBH
GetSystemTimeAsFileTime
failureCount
IsHighLight
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__ClipboardControlPageActivationFactory
Windows.ApplicationModel.Resources.Core.ResourceContext
{xbu_
AddressPostalCode
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
isSingleView
)L$PH
QuickLinkItem
Windows.Foundation.IReferenceArray`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
AlphaSymbolsExtended
howClosed
?"tWD
@SUVATAUAVAWH
SetUnhandledExceptionFilter
.?AVtype_info@@
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItemType
:)l-/u!
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.Styles
D$ E3
.text
IsActivated
H;K`M
onLaunchCallCount
Emoji_Symbol
featureId
CandidateDisplayString
.PE$AAVOutOfBoundsException@Platform@@
f9Axu`
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
originatingContextId
d:\os\src\shellcommon\composable\components\textinput\hostapp\candidatecontrolpage.xaml.cpp
WAUAVH
L$`E3
CommandLineLaunch
cntrl
A^A]_
WindowsInternal.ComposableShell.Experiences.TextInput.LanguageSwitcherViewModel
InputAppCreateView
d:\os\src\shellcommon\composable\components\textinput\hostapp\multiviewmanager.cpp
?__abi_WinRTraiseChangedStateException@@YAXXZ
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DefaultPlatformAdapter
keyboardId
0A_A^A]A\^][
D9d$P}lH
.idata$4
TextFramework
??0OutOfMemoryException@Platform@@QE$AAA@XZ
PointerInputPanel
;t$p|
.PE$AAVNotImplementedException@Platform@@
Dictation close button pressed
CoGetContextToken
`A_A^A]A\_^[
_o___stdio_common_vswprintf
T$pL;L$`u
DeactivateOtherViews
AddressStateOrProvince
_o__cexit
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateTipControl
SwitchKey
subViewType
Windows.UI.Xaml.DependencyObject
9\uJH
api-ms-win-core-com-l1-1-0.dll
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputModel
9\uMH
H;D$(t2H
ExpressiveInputControlPage
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarItemID
Items
Symbols
d:\os\src\shellcommon\composable\components\textinput\hostapp\expressiveinputcontrolpage.xaml.cpp
__C_specific_handler
CurrentInputScope
ImePadButton
0A_A^A]A\_^]
std::exception: %hs
(D$@f
Sticker
MaxSize
bad allocation
D9s u
.text$mn$00
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.ITextFrameworkAdapter, WindowsInternal.ComposableShell.Experiences.TextInput.ITextFrameworkKeyboardChangedEventArgs>
t$ WH
SetLastError
.rsrc$01
ucH;{ u]
CallContext:[%hs]
DebugBreak
3bad cast
SymbolViewCurrentCategory
A_A^A]A\_^[]
TextInput
D$pE3
8XLu.H
KeyboardShortcut
{|]uxH
ShellPreferenceInitialized
ntelD
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?id@?$collate@_W@std@@2V0locale@2@A
DisplayStringValue
d$0I;
_o__invalid_parameter_noinfo
InitializeSListHead
D$@H+D$8H
api-ms-win-core-util-l1-1-0.dll
Personalization_Items
3YWu!
_CxxThrowException
t+fE91t%L
AlphaSymbols
Common_Settings
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.PersonalityControl
H;K@M
LeaveCriticalSection
_o__set_fmode
ProtocolForResults
ClipboardViewer view state changed.
keyboardPosition
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
L$ SVWH
D9l$@}'H
Windows.Foundation.EventHandler`1<Boolean>
Windows.Foundation.EventHandler`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.HideStoryboardCompletedEventArgs>
CharacterWidth
TelephoneCountryCode
Microsoft Corporation. All rights reserved.
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
callContext
L$PH3
WindowsInternal.ComposableShell.Experiences.TextInput.InputSwitcherStylesAndTemplates
WindowsInternal.ComposableShell.Experiences.TextInput.TextInput_XamlTypeInfo.XamlMetaDataProvider
ItemFlag
KeyBlock
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
@A^_^][
.text$yd
RemoveFromList
UserDataAccountsProvider
api-ms-win-core-localization-l1-2-0.dll
WindowsInternal.ComposableShell.Experiences.TextInput.IInputProfileDataSource
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateItem
cF8!0
PersonalNamePrefix
IsChecked
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
api-ms-win-core-winrt-l1-1-0.dll
@.rsrc
ActionLink
ShowSubLabel
^|H;N
AcquireSRWLockExclusive
ExtraDescription
api-ms-win-crt-private-l1-1-0.dll
WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.KeyboardKeyType
`A_A^A]A\_^]
?UninitializeData@Details@Platform@@YAXH@Z
IsActionable
l$ E3
LegalCopyright
9D$tuYH
function
)l-/L
xdigit
MTFPrediction
@8yxt
9\uCH
_Wcsxfrm
originLineNumber
H;|$(u
DirectionalNavigationHighlight
LcF4D
UAUAVH
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
_o___std_exception_copy
00000409
L$0H3
[ UVWH
alpha
KeyActionHandler
wilActivity
fD9<Bu
.rdata$zzzdbg
Columns
f94Au
_o__initialize_narrow_environment
MoreMoreCandidate
.?AVInProcModule@Details@Platform@@
WAVAWH
:\u:L
Private
.rdata
FontSize
NumberFullWidth
Hiragana
api-ms-win-core-errorhandling-l1-1-0.dll
??0_Locinfo@std@@QEAA@PEBD@Z
Windows.ApplicationModel.Activation.ActivationKind
H;0u*L
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.ViewName>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IChildKeyPanel
|$0H;
OnlineSticker
minATL$__a
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
tGf9)u;H
wcsstr
:cY7.u!
Hcs4A;w4}EH
Digits
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarItem
?__abi_WinRTraiseNullReferenceException@@YAXXZ
FlyoutInputMode_FullWidthAlphaNumeric
WaitForSingleObject
StringValue
WebAccountProvider
Windows.Foundation.EventHandler`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateWindowTriggerState>
PersonalSurname
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarContextMenuItemID
Expressive Input shows up location view by space + @.
GetModuleFileNameA
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarItemType>
PA_A^A\_^[]
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputGroupLabelType
_o__set_app_type
0A_A^A\
_register_thread_local_exe_atexit_callback
print
api-ms-win-core-sysinfo-l1-1-0.dll
memcpy
.idata$3
WindowsIsStringEmpty
Invalid
H;{(t*H
Windows.Foundation.IReference`1<Windows.ApplicationModel.Activation.ActivationKind>
H!|$8H
|$ HcN
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.pdb
RtlDllShutdownInProgress
punct
SettingsManager
ClipboardControlPage
string too long
keyboardMode
Dictation hotkey show
LaunchIMEPad
ToolTipStringValue
keyboardLayoutView
oInputAppLaunch
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveUIStyles
CandidateControlPage_SettingsValueChanged
(_^][
UATAUAVAWH
HeapFree
9\u5L
currentContextId
FlyoutInputMode_Hiragana
CtfD;
NoResult
fA96u
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.IViewPositionAndSizeManager, String>
WindowsInternal.ComposableShell.Experiences.TextInput.Clipboard.ClipboardControlModel
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarList
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IDirectionalNavigationHighlight
L$@H3
G0E8p
PickerReturned
FlyoutInputMode_HalfWidthKatakana
Pinned
Windows.Foundation.Collections.IVector`1<Object>
RqdvV
T$`E3
UWAVH
@8yPt
FlyoutInputMode_FullWidthKatakana
@VWAVH
EventSetInformation
??Bid@locale@std@@QEAA_KXZ
PinNumeric
>3B>1
D8d$!t)I
_c_exit
UWAUAVAWH
ImageFilePath
OutputDebugStringW
CtH;K
ActiveProfile
tQD8d$!
SymbolsLatin
stoi argument out of range
@SVWAVAWH
ReturnHr
_o__set_new_mode
LockScreenCall
D$0H9
ExtendedSymbols
EmailAddress
ContactPicker
PickFileContinuation
space
A^A\]
.CRT$XTA
SIP_TwelveKey
H9>tlH
HeaderFontSize
CandidateItemList
A^_^[
DateDay
CurrencyAmount
HideStoryboard
@8,1u
zh-Hans-CN
@SUVWATAVAWH
WATAUAVAWH
AlphaLatin12Key
Device
Close Button Pressed
fD9t]
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
.?AV?$WriteOnlyArray@PE$AAVString@Platform@@$00@Platform@@
.PE$AAUIPrintable@Details@Platform@@
A_A^A]A\_
|$ E3
.CRT$XCAA
Platform.?$WriteOnlyArray@PE$AAVString@Platform@@$00
originCallerReturnAddressOffset
Windows.UI.Xaml.Controls.Frame
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
Windows.Foundation.PropertyValue
ReleaseSRWLockShared
\$ UH
D$xH!D$0L
Windows.UI.Xaml.Controls.UserControl
Windows.Foundation.EventHandler`1<Object>
.CRT$XTZ
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IXamlKeyboardCandidateWindow, Object>
KatakanaFullWidth
L9{0t#H
.00cfg
Windows.Foundation.Size
^\s+|\s*,\s*|\s+$
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.FlowerPanel
Launch
FailFast
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.TextItem
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.AdaptiveUIStyles
T$0E3
Windows.UI.Text.Core.CoreTextInputScope
UVWATAVH
ChildKey
StandardItem
,8?QD1
WindowsInternal.ComposableShell.Experiences.TextInput.Clipboard.ClipboardControlContainer
CompanyName
CurrencyAmountAndSymbol
d:\os\src\shellcommon\composable\components\textinput\hostapp\app.xaml.cpp
.PE$AAVDisconnectedException@Platform@@
LayoutDirection
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.SelectCandidateWithRemoveFlagBehavior>
GetCurrentThreadId
@A_A^_
ContactInfo
}0H+}(H
WaitForThreadpoolTimerCallbacks
MetadataFontFamily
Platform.?$WriteOnlyArray@VXmlnsDefinition@Markup@Xaml@UI@Windows@@$00
@SVWATAUAVAWH
FireEventOnPropertyChange
_o__exit
GetProcessHeap
FlowerPanelControl
AutomationName
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
NewWord
StartupTask
VisibilityInPersonalization
FileName
EnabledFeatureUsage
SIP_Narrow
.PE$AAVObject@Platform@@
u0HcH<H
t$ UWATAVAWH
InputPanelPageActivationChanged
@SUVWAVAWH
_o__errno
MetadataFontOverride
jcY7.
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationButtonBase
T$0H+
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CloseButtonPressedEventHandler
Windows.Foundation.IReference`1<Windows.UI.Text.Core.CoreTextInputScope>
BE}(p
ImageStream
td@85[
WindowsGetStringLen
H9_Hs<
ReleaseSemaphore
DD$@H
)L$@H
PersonalNameSuffix
D9{ u
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
HandwritingRecognitionFromOtherEngine
d:\os\src\shellcommon\composable\components\textinput\hostapp\inputpanelpage.xaml.cpp
PA_A^A]A\_^]
L$HH;L$Pt!A
InputPanelHideAnimationCompleted
FlyoutSetting_Orientation
l$ VWAVH
D$HH!\$@H
L$ L9
AutoCorrect
USVWAVH
callerModule
CloseThreadpoolTimer
HideInputAppViewActivity
Bopomofo
HcK0H
(null Message)
IsTipsLauncherAvailable
_Wcscoll
L$ SUVWH
D9d$P
StandardKeyRef
Default
FileOpenPicker
t^\gd
wcsrchr
?_Xlength_error@std@@YAXPEBD@Z
CurrentLanguage
o5InputPanelPageLoad
_o__initialize_onexit_table
_o_free
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__CandidateControlPageActivationFactory
PrintWorkflowForegroundTask
UATAVH
D$PE3
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputGroup
DictationPanelActivation
FeatureVariantUsage
?__abi_WinRTraiseNotImplementedException@@YAXXZ
memmove
?__abi_FailFast@@YAXXZ
E#KQ$`H
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
(caller: %p)
ms-appx://InputApp/CandidateControlPage.xaml
Model
?__abi_WinRTraiseDisconnectedException@@YAXXZ
strchr
)l-/sT>_
AdaptiveControl
Bcp47FromLcid
lower
Windows.UI.Xaml.Controls.Grid
CandidateFontOverride
FeatureUsage
.rtc$TAA
Width
IsLanguageSwitcherVisible
HangulHalfWidth
CandidateFontSize
tIfD9
040904B0
FlyoutDictionaryTool_AddOnDictionary
.CRT$XIC
D9w tJH
Requested show Gaze Keyboard
.rdata$zETW2
Windows.Foundation.IReferenceArray`1<String>
M H1E
WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.LayoutDataResourceLoader
Windows.Foundation.Collections.IIterator`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
wcslen
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.AdaptiveControl
Ji"R<
@USVWAVH
Padding
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__ExpressiveInputControlPageActivationFactory
WindowsDeleteString
AcquireSRWLockShared
ms-appx://InputApp/InputPanelPage.xaml
WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.KeyboardDataStore
KeyboardName
H9QPtc8QLu.H
.?AVbad_alloc@std@@
A_A^A]A\_^]
UserTypedWord
AddressStreet
.rtc$IZZ
L$PL+
Windows.UI.Xaml.RoutedEventHandler
A_A^]
TextString
??1facet@locale@std@@MEAA@XZ
AlphanumericFullWidth
Windows.UI.Xaml.Application
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.ExpressiveInputControlPage
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.inputapp_XamlTypeInfo.XamlMetaDataProvider
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IInputPanelModel
KeyboardShortcutFontSizeOverride
EC control
SettingsButton
Windows.UI.Xaml.Controls.Page
?_Xinvalid_argument@std@@YAXPEBD@Z
Identifier
?_Incref@facet@locale@std@@UEAAXXZ
AlphaLatinFull
InitOnceComplete
InkBoundingRect
MetadataFontSize
DllGetActivationFactory
f9)uBH
.rtc$IAA
PersonalGivenName
ti;Q(s^
AutomationId
LockScreenComponent
VoiceCommand
@SVWH
A_A^_^[
VWAUAVAWH
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
FlyoutSetting_Settings
VarFileInfo
31kEZ
StandardKey
tMfD91u@H
HideDelay
Windows.Foundation.Collections.IVectorView`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItem>
TUUUUUU
()$^.*+?[]|\-{},:=!
originModule
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationTextControlBase
Metadata
zDictationPanelActivation
api-ms-win-core-libraryloader-l1-2-0.dll
RtlUnsubscribeWnfNotificationWaitForCompletion
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
Label
AlphaInk
D$T9p
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.ClipboardControlPage
ItemInfoType
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.MultiViewViewMessageChannel
F0D8#ukD8c
Local\SM0:%d:%d:%hs
HasComment
A^_^][
MetadataFontSizeOverride
A^A]]
AlphaFunction
api-ms-win-core-winrt-string-l1-1-0.dll
FormatMessageW
AlphaLatinSymbols
Spacer
SingleViewMode
module
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
GutterSize
Platform.?$WriteOnlyArray@PE$AAUIXamlMetadataProvider@Markup@Xaml@UI@Windows@@$00
Emoji_Sticker
A_A^A]A\_
FormulaSymbols
D$@fD
.rtc$TZZ
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationPanelControl
CandidateRemoveBehavior
DeleteCriticalSection
RaiseException
\$ WH
RtlCaptureContext
minATL$__z
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__DictationControlPageActivationFactory
TelephoneNumber
x ATAVAWH
t{HcL$ HcD$$H
Windows.Foundation.TypedEventHandler`2<Windows.UI.Core.CoreWindow, Windows.UI.Core.VisibilityChangedEventArgs>
.?AV?$Module@$04VInProcModule@Details@Platform@@@WRL@Microsoft@@
FlyoutKanaMode_KanaModeOn
DateMonthName
Emoji
SelectedText
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputContentType
Windows.UI.Core.CoreCursor
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateWindowControl
ToolTip
Windows.Foundation.IAsyncOperation`1<Windows.Storage.Streams.IRandomAccessStream>
9{tu"
T$8H+
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ToolBarStyles
A_A^_
ms-appx://InputApp/ToolBarControlPage.xaml
HyperLinkCandidate
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
AlphaEmoji
ActivityError
TimeMinuteOrSecond
H;>u2I
CH}#6%
msvcp_win.dll
d:\os\src\shellcommon\composable\components\textinput\hostapp\clipboardcontrolpage.xaml.cpp
enabled
pageName
A_A^A\
HasKeyBubble
?__abi_WinRTraiseFailureException@@YAXXZ
originFile
DictationPanelDeactivate
D$0H;
api-ms-win-core-threadpool-l1-2-0.dll
Expressive Input shows up on ShellStateChanged.
CandidateString
api-ms-win-core-processthreads-l1-1-0.dll
Windows.Foundation.IReference`1<Boolean>
LocationInfo
FlyoutSetting_Hide
@USVWATAVAWH
Lcs8E;w8
FontFamily
10.0.17763.292
/resources/
d:\os\src\shellcommon\composable\inc\systemprofileresourcehelpercx.h
_o_terminate
ActiveModeProfile
A_A^A]_^
ReleaseSRWLockExclusive
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
XamlTypeInfo.InfoProvider.XamlMember
featureVersion
(D$pf
t>y&H
RtlLookupFunctionEntry
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarItemID>
InputAppPrelaunch
.8SLu
[%hs(%hs)]
EmojiKana
QueryPerformanceCounter
.PE$AAUIEquatable@Details@Platform@@
??0FailureException@Platform@@QE$AAA@XZ
threadId
t$0E3
\$ UVWATAUAVAWH
StringFileInfo
t$ WAVAWH
ToolBarContextMenuItems
0A_A^A]A\_
process
api-ms-win-core-handle-l1-1-0.dll
WindowsInternal.ComposableShell.Experiences.TextInput.KeyboardSettingsMenu
isMultiViewMode
ms-resource://
ToastNotification
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
@8ypt
.?AVModuleBase@Details@WRL@Microsoft@@
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.SelectCandidateWithRemoveFlagBehavior
LanguageSwitcherPanel
.text$mn
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
Hanja
failureId
Windows.ApplicationModel.Core.CoreApplication
DevicePairing
.?AVbad_array_new_length@std@@
SUVWATAUAVAWH
CandidateStringTextBlock
tH9XPu
d:\os\public\amd64fre\internal\sdk\inc\wil\resource.h
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.IViewPositionAndSizeManager, WindowsInternal.ComposableShell.Experiences.TextInput.IViewPositionAndSizeManagerViewStateChangedEventArgs>
addend
DecodePointer
EventWriteTransfer
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarItemID
?InitializeData@Details@Platform@@YAJH@Z
TTBLTR
Password
Common_Orientation
L$`H3
D$@E3
@A_A^_^[
pA_A^A\_^
?__abi_WinRTraiseCOMException@@YAXJ@Z
f9,Hu
IsKeyboardSettingsMenuVisible
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
FloatingCandidateWindowEnabled
Windows.Foundation.Collections.IObservableVector`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationStateErrorControl
WindowsGetStringRawBuffer
Annotation
This page should be loaded into secondary view so MultiViewMode is expected
DictationControlPage
SupportsSkinTonePicker
8A^_^[
ImeSwitch
H!~(H!~0H!~8H!~@3
IsDebuggerPresent
EventActivityIdControl
`A_A^A\_^
.rdata$zETW1
Windows.UI.Xaml.SuspendingEventHandler
A^A\_^]
displayOrientation
RtlVirtualUnwind
Kaomoji
_o__crt_atexit
SystemResources.ResourceLoader
InputProfileDataSource
AppointmentsProvider
pA_A^_^]
RaiseFailFastException
_o__get_narrow_winmain_command_line
api-ms-win-core-processthreads-l1-1-1.dll
Windows.UI.Xaml.Controls.Panel
Image
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationModel
Collapsed
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateUIConfig
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarContextMenuItemID>
WindowsInternal.ComposableShell.Experiences.TextInput.ShellViewPositionAndSizeManager
.CRT$XCA
.PEAX
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
RoGetActivationFactory
E9V0u
AlphanumericHalfWidth
.PE$AAVCOMException@Platform@@
WindowsInternal.ComposableShell.Experiences.TextInput.Clipboard.ClipboardUIStyles
D$8H+D$0H
Windows.UI.Xaml.Markup.IXamlType2
IsAvaliable
SetThreadpoolTimer
SettingItem
ItemIconString
fD90t,
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
UnhandledExceptionFilter
9\u5H
TimeHour
EventUnregister
LaunchDicTool
ChildKeyPanelControl
t>y#H
currentContextName
C9fD9?u-
RtlNtStatusToDosErrorNoTeb
@SUVWATAUAVAWH
_o___std_exception_destroy
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DefaultPersonalityFactory
Close button pressed
Int32
VS_VERSION_INFO
api-ms-win-core-synch-l1-2-0.dll
HotAndPopularCandidate
A_A^_^]
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
Candidate Window cleared
.CRT$XCZ
SearchIncremental
FormulaNumber
digit
Queued
featureBaseVersion
DialReceiver
E9e ~0I
map/set<T> too long
currentContextMessage
Exception
Windows.UI.Input.PointerVisualizationSettings
`A^_^[]
fD9>u$H
Windows.Foundation.Collections.IVector`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarContextMenuItem>
EmoticonButton
.CRT$XPA
ContentStreamAsync
RoFailFastWithErrorContext
.?AV?$Module@$00VInProcModule@Details@Platform@@@WRL@Microsoft@@
.data
AlphaLatinSymbolsExtended
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
CurrentSelectedChild
memset
SIP_Dictation
[%hs]
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ILanguageSwitcher
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
requestType
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ICandidateUIConfig
XamlTypeInfo.InfoProvider.XamlSystemBaseType
variant
\$ UVWAVAWH
GetProcAddress
ProductName
|$(A^
PH;L$(u
.PE$AAVException@Platform@@
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
.idata$6
Common_Personalization
Shell request rejected
ComponentUI
api-ms-win-core-heap-l1-1-0.dll
JsonMetadata
callerReturnAddressOffset
DictationControlViewStateChanged
ActivityIntermediateStop
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.KeyboardKeyType>
D$HE3
H;0u'L
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.TextInputCandidateItemFlag>
Candidates delivered for hwkb.
UnitKeyHeightInPixels
wincorlib.DLL
C0E8x
PositionAndSizeManager
t]fD9#tWH
Microsoft.Windows.Shell.TextInput.InputPanel
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateItemSource>
PA^_^
CHD1p
_o_malloc
t$ UWAVH
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.KeyboardSettingsMenuKey
FileVersion
cY7.L
FeatureError
L$hH3
@tI;H
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
p AWH
Windows.UI.Xaml.Media.Imaging.BitmapImage
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarItemID>
Source
t$ E3
Height
WindowsConcatString
WindowsInternal.ComposableShell.Experiences.TextInput.ITextInputSettingsManager
wilResult
DD$XH
SymbolsNumeric
(D$0f
UAVAWH
A_A^_
_o_exit
Address
UnitItemHeight
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarContextMenuItem
CompareStringOrdinal
F0A8X
CheckText
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
Unknown exception
IsBrowseVisible
Windows.ApplicationModel.Contacts.Contact
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
L$(H;
api-ms-win-crt-runtime-l1-1-0.dll
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateItemSource
?__abi_WinRTraiseInvalidCastException@@YAXXZ
Platform::Exception^: %ws
Print3DWorkflow
xA_A^A]A\_^[]
.?AUIDisposable@Platform@@
?is@?$ctype@_W@std@@QEBA_NF_W@Z
Windows.Foundation.IReference`1<UInt32>
__std_terminate
WindowsCreateString
UInt32
HcCHH
WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.ViewName
D$PH;
Switch to dictation panel
CoTaskMemAlloc
@UVWATAUAVAWH
CreateMutexExW
L$XL+
Windows.Foundation.Collections.IVectorChangedEventArgs
EventRegister
Windows.UI.Core.CoreWindow
SuspendUpdates
xf@8u
@UVWH
Bcp47Langs.dll
A_A^_^]
CloudDelivered
initialized
UserControl
SelectedItem
Removable
CandidateItemFlag
HeapAlloc
A_A^A\_^
minATL$__r
WebAuthenticationBrokerContinuation
|"HcF
L$pH3
ms-appx://InputApp/ExpressiveInputControlPage.xaml
H3E H3E
InternalName
ChineseFullWidth
Location
reason->Data()
9\u<H
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0.dll
.rsrc$02
Fixable
SkinToneIndex
D$@H!|$@D
?_Xbad_alloc@std@@YAXXZ
CandidateStringHyperlink
MetadataDisplayString
en-US
(t$0H
LanguageProfileItems
String
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItem
wasPrelaunched
.text$di
58_Lu
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
AddressCountryShortName
show-authentication-ui
.edata
originatingContextMessage
SIPButton
originCallerModule
VWATAVAWH
IsSuggestionEnabled
DisplayedCandidates
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ICandidateItem
KeyboardSettingsMenuKeyControl
L$(H3
Single
GetCurrentProcessId
L$XH3
??0InvalidArgumentException@Platform@@QE$AAA@XZ
@8y@t
.rdata$zETW0
CreateThreadpoolTimer
DisplayString
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
bcp47tag
/w4t*
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputControl
0A^_^][
.?AUIValueType@Platform@@
@8yht
WaitForSingleObjectEx
KeyboardShotcutFontSize
??0_Lockit@std@@QEAA@H@Z
KeyboardModeEnabled_hardwarekeyboardbar
Windows.UI.Xaml.Controls.Control
Windows.UI.Xaml.Window
C0E8p
ChineseHalfWidth
Windows.Foundation.Collections.IVectorView`1<String>
Contact
??0Object@Platform@@QE$AAA@XZ
WindowsDuplicateString
g2{w'
AddressCountryName
NotInstall
@USVWH
CoTaskMemFree
AlphaLatin
rMfD9?w
{xbuY
.CRT$XIZ
BarcodeScannerProvider
,<+|U
Candidates delivered for hwkb bar
.?AVinvalid_argument@std@@
InitializeCriticalSectionEx
??0facet@locale@std@@IEAA@_K@Z
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputItemType>
!This program cannot be run in DOS mode.
Msg:[%ws]
EmailUserNameOrAddress
@A^_^
Common_Hide
api-ms-win-eventing-provider-l1-1-0.dll
v(A;w4|
AlphaLatinFunction
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
Windows.Foundation.Collections.IVectorView`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DisplayedCandidateData>
A_A^A]A\_^[
Windows.Foundation.IReference`1<Windows.Foundation.Size>
?__abi_WinRTraiseWrongThreadException@@YAXXZ
0rau!
A^_^[]
InputPanelPage
CandidateIndex
HardwareKeyboardBar
t"D8=
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.InputPanelControl
api-ms-win-core-synch-l1-1-0.dll
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
D$ fD
t$XH!\$0L
L9{@u
OpenSemaphoreW
WindowsInternal.ComposableShell.Experiences.TextInput.IViewPositionAndSizeManager
;u sLM
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.App
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IPagedListModel
LockScreen
FallbackError
EnterCriticalSection
.CRT$XCU
MaxToolBarItem
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
FontSizeScaling
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ICandidateControlState
ShellPreferences
T$XH;
T$@L;
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.JpnToolBarList
Windows.ApplicationModel.Resources.Core.ResourceManager
Gripper
Personalization_Reset
Windows.UI.Xaml.Media.Animation.Storyboard
Search
graph
%hs(%d) tid(%x) %08X %ws
H9\$(t
Windows.Foundation.IReferenceArray`1<Windows.UI.Xaml.Markup.XmlnsDefinition>
SupportSuggestions
GetCurrentProcess
NameOrPhoneNumber
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarItem
Number
shouldActivate
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IUIComponentTemplateManager
FilePath
fileName
:\u5L
InputPanelPageLoad
L9o@t
.?AVResultException@wil@@
9t$p~;H
Windows.UI.Xaml.ApplicationInitializationCallback
CloseButton
activationKind
Translation
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
RestrictedLaunch
Windows.Foundation.Collections.IVectorView`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
A_A^A]A\_^]
Windows.Graphics.Display.DisplayInformation
AlphaMore
IsRecoResult
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ICandidateWindowModel
alnum
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ToolBarControl
t$8H!\$PL
d:\os\public\amd64fre\internal\sdk\inc\wil\result.h
WilError_02
InvokedKeyType
IsAnimationEnabledBySystem
.?AV?$Array@PE$AAVString@Platform@@$00@Platform@@
fD94Pu
_o__callnewh
9k(tyH
Control Deactivated
Windows.Foundation.Collections.IVectorView`1<UInt32>
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.ToolBarControlPage
??0NotImplementedException@Platform@@QE$AAA@XZ
Windows.UI.Xaml.Controls.Button
keyboardSet
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.DictationControlPage
.CRT$XIAC
ProductVersion
EnableInAppAnimation
Visible
.PE$AAVOutOfMemoryException@Platform@@
tHfD91u;H
.?AU?$IBoxArray@PE$AAVString@Platform@@@Platform@@
featureStage
SymbolViewCategory
__CxxFrameHandler3
variantKind
.CRT$XIAA
fD9<Au
FlyoutMenuItem
failureType
LayoutPositionProfileItems
` AVH
H;L$Pu
_o__configure_narrow_argv
Windows
Windows.ApplicationModel.Package
hresult
??0DisconnectedException@Platform@@QE$AAA@XZ
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ScrollButton
D$0E3
8A_A^_^][
unH9A
Microsoft.Windows.Wil.FeatureLogging
.idata$2
??0Delegate@Platform@@QE$AAA@XZ
api-ms-win-core-debug-l1-1-0.dll
x AVH
SingleCharacter
.CRT$XCL
.?AVObject@Platform@@
Windows.Foundation.EventHandler`1<WindowsInternal.ComposableShell.Experiences.TextInput.ITextFrameworkKeyboardChangedEventArgs>
InputAppLaunch
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputSet
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.AdaptiveGroup
FlyoutCustomization_SetDefault
PinAlphanumeric
Windows.UI.Xaml.WindowSizeChangedEventHandler
CurrencyChinese
.xdata
PickFolderContinuation
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChsToolBarList
.gfids
Windows.UI.Xaml.Controls.ContentControl
Windows.UI.Core.DispatchedHandler
KanaFunction
%hs(%d)\%hs!%p:
Operating System
FileSavePicker
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.CandidateControlBase
vector<T> too long
Windows.Foundation.IReference`1<WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ExpressiveInputContentType>
GetModuleHandleExW
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationSwitchButton
CachedFileUpdater
_o_realloc
.?AVbad_cast@std@@
;cY7.u'
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.IExpressiveInputComponentControl
AccNameResource
Searchable
Windows.UI.Xaml.ResourceDictionary
MultiViewMode
Formula
d:\os\src\shellcommon\composable\components\textinput\hostapp\dictationcontrolpage.xaml.cpp
t$ WATAUAVAWH
GetLastError
@USVWATAUAVAWH
UWAWH
GameUIProvider
CandidateWindowModel
AuthD
LogHr
ImageSource
CandidateItemInstance
Shell requested show
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.ChtToolBarItemType
fD94Ku
Windows.UI.Xaml.Controls.HyperlinkButton
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__InputPanelPageActivationFactory
WindowsInternal.ComposableShell.Experiences.TextInput.Controls.DictationHintControl
Unknown
ChatWithoutEmoji
fD94Gu
WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.__ToolBarControlPageActivationFactory
WindowsCompareStringOrdinal
TemplateManager
pA_A^A]A\_^]
PersonalMiddleName
Windows.UI.Xaml.UIElement
invalid stoi argument
Index
api-ms-win-core-winrt-error-l1-1-1.dll
A_A^A]A\]
A_A^A]_]
InitOnceBeginInitialize
UserName
ms-appx://InputApp/ClipboardControlPage.xaml
Windows.UI.Xaml.Controls.TextBlock
Windows.Foundation.IReference`1<Single>
_o___stdio_common_vsnprintf_s
WindowsInternal.ComposableShell.Experiences.TextInput.BindableBase
`.rdata
L;0u*H
{xuux
9S|ucH
Windows.Foundation.TypedEventHandler`2<WindowsInternal.ComposableShell.Experiences.TextInput.IViewPositionAndSizeManager, Boolean>
H;D$(u
lineNumber
TelephoneLocalNumber
C0A8h
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | PDB Path | Compile Time | Import Hash | Exported DLL Name |
|---|---|---|---|---|---|---|---|---|
| 0x140000000 | 0x00088070 | 0x000ed185 | 0x000ed185 | 6.2 | WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.pdb | 2019-01-16 05:59:41 | 83fc5ba8260fe02592d4ef7f6337a8d4 | WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe |
Version Infos
| CompanyName | Microsoft Corporation |
|---|---|
| FileDescription | WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe |
| FileVersion | 10.0.17763.292 (WinBuild.160101.0800) |
| InternalName | WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.17763.292 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x0008c7c6 | 0x0008c800 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.23 |
| .rdata | 0x0008cc00 | 0x0008e000 | 0x00049db2 | 0x00049e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.58 |
| .data | 0x000d6a00 | 0x000d8000 | 0x0000a258 | 0x00009600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.55 |
| .pdata | 0x000e0000 | 0x000e3000 | 0x00006d68 | 0x00006e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.96 |
| .rsrc | 0x000e6e00 | 0x000ea000 | 0x00000538 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.06 |
| .reloc | 0x000e7400 | 0x000eb000 | 0x00002288 | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 5.40 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x000ea060 | 0x000004d4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.49 | None |
Imports
| Name | Address |
|---|---|
| EventUnregister | 0x14008e480 |
| EventSetInformation | 0x14008e488 |
| EventRegister | 0x14008e490 |
| EventActivityIdControl | 0x14008e498 |
| EventWriteTransfer | 0x14008e4a0 |
| Name | Address |
|---|---|
| DebugBreak | 0x14008e038 |
| OutputDebugStringW | 0x14008e040 |
| IsDebuggerPresent | 0x14008e048 |
| Name | Address |
|---|---|
| GetCurrentThreadId | 0x14008e100 |
| TerminateProcess | 0x14008e108 |
| GetStartupInfoW | 0x14008e110 |
| GetCurrentProcessId | 0x14008e118 |
| GetCurrentProcess | 0x14008e120 |
| Name | Address |
|---|---|
| FormatMessageW | 0x14008e0f0 |
| Name | Address |
|---|---|
| GetProcessHeap | 0x14008e098 |
| HeapAlloc | 0x14008e0a0 |
| HeapFree | 0x14008e0a8 |
| Name | Address |
|---|---|
| CompareStringOrdinal | 0x14008e170 |
| Name | Address |
|---|---|
| UnhandledExceptionFilter | 0x14008e058 |
| RaiseException | 0x14008e060 |
| GetLastError | 0x14008e068 |
| SetUnhandledExceptionFilter | 0x14008e070 |
| SetLastError | 0x14008e078 |
| Name | Address |
|---|---|
| WindowsGetStringRawBuffer | 0x14008e2b0 |
| WindowsIsStringEmpty | 0x14008e2b8 |
| WindowsDeleteString | 0x14008e2c0 |
| WindowsGetStringLen | 0x14008e2c8 |
| WindowsDuplicateString | 0x14008e2d0 |
| WindowsCreateString | 0x14008e2d8 |
| WindowsConcatString | 0x14008e2e0 |
| WindowsCompareStringOrdinal | 0x14008e2e8 |
| WindowsCreateStringReference | 0x14008e2f0 |
| Name | Address |
|---|---|
| RoGetActivationFactory | 0x14008e2a0 |
| Name | Address |
|---|---|
| AcquireSRWLockExclusive | 0x14008e180 |
| InitializeCriticalSectionEx | 0x14008e188 |
| LeaveCriticalSection | 0x14008e190 |
| EnterCriticalSection | 0x14008e198 |
| CreateMutexExW | 0x14008e1a0 |
| WaitForSingleObjectEx | 0x14008e1a8 |
| ReleaseMutex | 0x14008e1b0 |
| OpenSemaphoreW | 0x14008e1b8 |
| ReleaseSemaphore | 0x14008e1c0 |
| DeleteCriticalSection | 0x14008e1c8 |
| InitializeCriticalSection | 0x14008e1d0 |
| ReleaseSRWLockShared | 0x14008e1d8 |
| AcquireSRWLockShared | 0x14008e1e0 |
| ReleaseSRWLockExclusive | 0x14008e1e8 |
| CreateSemaphoreExW | 0x14008e1f0 |
| WaitForSingleObject | 0x14008e1f8 |
| Name | Address |
|---|---|
| InitOnceBeginInitialize | 0x14008e208 |
| InitOnceComplete | 0x14008e210 |
| Name | Address |
|---|---|
| SetThreadpoolTimer | 0x14008e238 |
| CreateThreadpoolTimer | 0x14008e240 |
| WaitForThreadpoolTimerCallbacks | 0x14008e248 |
| CloseThreadpoolTimer | 0x14008e250 |
| Name | Address |
|---|---|
| GetSystemTimeAsFileTime | 0x14008e220 |
| GetTickCount64 | 0x14008e228 |
| Name | Address |
|---|---|
| CloseHandle | 0x14008e088 |
| Name | Address |
|---|---|
| GetModuleHandleExW | 0x14008e0c8 |
| GetModuleFileNameA | 0x14008e0d0 |
| GetProcAddress | 0x14008e0d8 |
| GetModuleHandleW | 0x14008e0e0 |
| Name | Address |
|---|---|
| CoCreateFreeThreadedMarshaler | 0x14008e010 |
| CoGetContextToken | 0x14008e018 |
| CoTaskMemFree | 0x14008e020 |
| CoTaskMemAlloc | 0x14008e028 |
| Name | Address |
|---|---|
| _initterm | 0x14008e440 |
| _initterm_e | 0x14008e448 |
| _c_exit | 0x14008e450 |
| _register_thread_local_exe_atexit_callback | 0x14008e458 |
| Name | Address |
|---|---|
| Bcp47FromLcid | 0x14008e000 |
| Name | Address |
|---|---|
| RoFailFastWithErrorContext | 0x14008e270 |
| RoOriginateError | 0x14008e278 |
| SetRestrictedErrorInfo | 0x14008e280 |
| Name | Address |
|---|---|
| RoReportUnhandledError | 0x14008e290 |
| Name | Address |
|---|---|
| DecodePointer | 0x14008e260 |
| Name | Address |
|---|---|
| RtlCaptureContext | 0x14008e150 |
| RtlLookupFunctionEntry | 0x14008e158 |
| RtlVirtualUnwind | 0x14008e160 |
| Name | Address |
|---|---|
| IsProcessorFeaturePresent | 0x14008e130 |
| Name | Address |
|---|---|
| QueryPerformanceCounter | 0x14008e140 |
| Name | Address |
|---|---|
| InitializeSListHead | 0x14008e0b8 |
Exports
| Name | Address | Ordinal |
|---|---|---|
| DllCanUnloadNow | 0x140088c00 | 1 |
| DllGetActivationFactory | 0x140088c20 | 2 |
Usage
Processing ( 0.95 seconds )
- 0.928 CAPE
- 0.012 BehaviorAnalysis
- 0.006 AnalysisInfo
- 0.001 Debug
Signatures ( 0.06 seconds )
- 0.008 ransomware_files
- 0.006 antiav_detectreg
- 0.005 antianalysis_detectfile
- 0.005 ransomware_extensions
- 0.003 infostealer_ftp
- 0.003 ursnif_behavior
- 0.002 antiav_detectfile
- 0.002 infostealer_im
- 0.002 poullight_files
- 0.002 territorial_disputes_sigs
- 0.001 banker_zeus_p2p
- 0.001 antianalysis_detectreg
- 0.001 antivm_vbox_files
- 0.001 antivm_vbox_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 infostealer_bitcoin
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 infostealer_mail
- 0.001 masquerade_process_name
- 0.001 revil_mutexes
- 0.001 modirat_behavior
Reporting ( 0.00 seconds )
- 0.003 CAPASummary
- 0.001 JsonDump
Signatures
SetUnhandledExceptionFilter detected (possible anti-debug)
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
The PE file contains a suspicious PDB path
anomaly: the pdb path contains a suspicious string
pdbpath: WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.pdb
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
\Device\CNG
C:\Windows\System32\en-US\KERNELBASE.dll.mui
\Device\CNG
C:\Windows\System32\en-US\KERNELBASE.dll.mui
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
Local\SM0:1436:304:WilStaging_02
Local\SM0:1436:120:WilError_03
Local\SM0:1436:120:WilError_03
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.