We’re back with the fourth part of the Windows 11 exploration, but we’ve promised that we’ll go deep to the point of finding bugs. Let’s see what we have to offer for this part.
New feature in Task Manager
Windows 11’s Task Manager shows three extra columns for the Details tab which shows the detailed information for the processes that are running on your computer. We know that it’s a little bit annoying not being able to open the Task Manager by right-clicking on the empty area of the Taskbar, but we can, using CTRL+SHIFT+ESC, or right-clicking on the Windows 11 icon. These are the three columns, to be exact:
- Architecture: Architecture on which the process is running.
- Hardware-enforced Stack Protection: Specifies the status of Hardware-enforced Stack Protection (a security feature using shadow stacks) for the process.
- Extended Control Flow Guard: Specifies the status of Extended Control Flow Guard (XFG, a security feature) for the process.
Some internal changes in system files
Looking at the Windows folder, we saw BrowserCore, an application that reads some kind of requests from the supported Chrome extensions according to the manifest JSON file found in the same directory. However, the input remains undocumented (if you figure it out, let us know)
For now, when we write anything to the input, we get the “Error processing request” in the JSON form.
The supported Chrome extensions according to the manifest are:
- ppnbnpeolgkicgegkbkbjmhlideopiji: Windows 10 Accounts
- ndjpnladcallmjemlbaebfadecfhkepb: Office Online
- jfhehocgaajmfnaelknegmnnkgkemgcb: Unknown (probably internal)
When we looked further, we saw InboxApps. Inside, it has two MSIX files that appear to be small packages. Unfortunately, they can’t be installed because they’re untrusted, as seen below:
According to the package installer, the first package claims that it’s Flipgrid, a video conference program for families and learners. The publisher was flipgrid.com with the version of 1.0.0.0.
The second package claims that it’s Outlook, an e-mail program from Office. The publisher was outlook.office.com with the version of 1.0.0.0.
This is the SystemTemp folder, which doesn’t exist in Windows 10.
There is a UUS folder in Windows that also doesn’t exist in Windows 10. It claims that it’s an Undocked Update Stack for Windows Update. The UUSP.JSON file has some sort of metadata for the update stack. Here’s the full version of it:
{
"ver": "121.511.1.0",
"sessions": {
"mousocoreworker": "MoUsoCoreWorker",
"trayiconutil.musnotifyicon": "MusNotifyIcon",
"usoclient": null,
"usoclientimpl": null,
"usosvc.mousocoreworker": "MoUsoCoreWorker",
"usosvc.usosvcimpl": "UsoSvcImpl",
"deliveryoptimization": null
},
"components": {
"MoUsoCoreWorker": {
"velocity": {
"id": 29571617,
"state": "DisabledByDefault",
"changeTime": "OnReboot"
}
},
"MusNotifyIcon": {
"velocity": {
"id": 30080629,
"state": "EnabledByDefault",
"changeTime": "OnReboot"
}
},
"UsoSvcImpl": {
"velocity": {
"id": 31411556,
"state": "AlwaysDisabled",
"changeTime": "OnReboot"
}
}
},
"payload": {
"UUS.Core": [
"UusBrain.dll",
"MoUsoCoreWorker.exe",
"UsoClientImpl.dll",
"UusFailover.dll",
"UsoSvcImpl.dll",
"doclient.dll",
"domiprov.dll"
],
"UUS.Desktop": [
"MusNotifyIcon.exe"
]
}
}
This is the folder that has the actual DLL for the undocumented Undocked Update Stack. Its core is called UusBrain.dll.
WUModels folder also doesn’t exist in Windows 10. It claims that it’s controlling Windows Update models, like the quality updates. However, you can’t open them by default without having to change permission settings. If you successfully manage to open them, they’re encrypted (obfuscated to be exact).
The OOBE folder in Windows 11 has about the same structures as Windows 10, but with the few design changes, including the FirstLogonAnim.html where it was changed. You can look at the animation by double clicking on the HTML file and opening Microsoft Edge on it. It even works on our Windows 10 computer!
So, moving on to the final folder before going back to Settings.
In Pbr/ActionFiles, we can see a Plugins.xml file, and when open, it lists two PBR Plugins, called Microsoft-Windows-License-Protection, and Microsoft-Windows-Reset-EdgeResetPlugin. The former plugin protects the license of the system, and the latter enables the reset feature for Microsoft Edge.
Some more Settings
Latest versions of Windows 10 features Archive Apps, and so is the leaked build of Windows 11. This is to save storage space and Internet bandwidth. The next time you need to access these apps, it will connect to the internet to download the full version of the app if it’s still available through Microsoft Store.
Add an optional feature features the new look with an option of selecting multiple optional features and installing them in one click. There’s a Wireless Display feature, though.
New features
The first picture shows the Clipboard settings with the floating clipboard selector open. It’s been improved to not only shows you the multiple clipboard items, but also shows things like GIF, Kaomoji, emoji, and so on. It’s open at the first page.
The second picture shows you the emoji selector by category or by searching.
The third picture shows you the Kaomoji selector just by category.
The final page shows you the multiple clipboards, as we told you previously.
When you hover over the Maximize button, instead of showing you the tooltip that says “Maximize,” it shows you the acrylic pad with various grid buttons, grouped in four windows with the different grid patterns. Clicking on a grid maximizes the window to the selected grid.
With the optional feature of “Internet Explorer Mode” installed, you can use this mode in Microsoft Edge to load sites in IE mode for compatibility. It’s available in Windows 10, but as “Internet Explorer 11” optional feature.
Now, let’s see what bugs and interesting things we have to show you.
Bugs and Interesting Things
In the Windows Recovery Environment, when you open the winver dialog in any way, like the CMD, you would see that the operating system name is incorrectly rendered. Instead of being “Windows 11,” it’s the series of letters that change in each run.
In Safe Mode, when explorer.exe is run for more than two minutes, the stack-based buffer will overrun, causing Windows to show this error message. If you click on OK, the system will restart Explorer and the loop will continue. Opening the Task Manager, see below:
During 
After
See? Between the time Explorer is restarted and the system error will yield, it seems that the CPU is being used constantly by Windows Explorer with the RAM usage going up constantly. After it went up to ~300+ MB RAM, the CPU usage stops, but yields the above error message. If Explorer is killed by pressing the OK button, this repeats all over again.
This may not be exclusive to Windows 11, but if you killed the LSASS.EXE process in Task Manager, this message will appear. After a minute, instead of going to “Rebooting” screen with the spinning circles, it “resets” as if someone pressed the hardware reset button on your computer. When Windows 11 starts back up, it starts up very fast as opposed to the regular reboot.
If the system was slow at the time the Windows Search is loading, you can see the version details in the lower right corner. This build has the 2021.05.10.20895903.US.en-US version, which suggested that this version was built in Monday, May 10, 2021.
The last interesting thing we had to show you is the blue screen. Instead of being the Green Screen of Death like the Windows Insider builds show, it shows the regular BSOD as used in the final releases of Windows 10. This suggests that this build is an Internal Insider build made as the internal “release” build.
We’re done for now
That’s enough for this part. We hope you like it. Follow this blog for more updates regarding Windows 11, Ubuntu, and any other computer subjects.
Aptivi 
Thoughts?