Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	7.94%
6.3.9600.16384 (winblue_rtm.130821-1623)	9.52%
6.2.9200.16384 (win8_rtm.120725-1247)	1.59%
6.2.9200.16384 (win8_rtm.120725-1247)	3.17%
6.1.7600.16385 (win7_rtm.090713-1255)	60.32%
6.1.7600.16385 (win7_rtm.090713-1255)	15.87%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	1.59%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

tabtip32.exe (Touch Keyboard and Handwriting Panel Helper by Microsoft Corporation)

PE file structure

Show functions

Import table

api-ms-win-core-debug-l1-1-1.dll

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-1.dll

RaiseException, UnhandledExceptionFilter, SetLastError, GetLastError, SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-0.dll

CompareFileTime, CreateFileW, GetFileTime

api-ms-win-core-handle-l1-1-0.dll

CloseHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, HeapSetInformation, HeapReAlloc, HeapAlloc, HeapDestroy, HeapSize, GetProcessHeap

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedIncrement, InterlockedDecrement, InterlockedExchange, InterlockedCompareExchange

api-ms-win-core-kernel32-legacy-l1-1-0.dll

RegisterWaitForSingleObject, UnregisterWait, LoadLibraryW

api-ms-win-core-libraryloader-l1-1-1.dll

GetModuleHandleW, GetModuleHandleA, FreeLibraryAndExitThread, GetModuleHandleExW, LoadLibraryExW, GetModuleFileNameW, GetProcAddress, FreeLibrary

api-ms-win-core-processenvironment-l1-2-0.dll

GetCommandLineW

api-ms-win-core-processthreads-l1-1-1.dll

TerminateProcess, OpenProcess, CreateThread, GetCurrentProcessId, ProcessIdToSessionId, GetStartupInfoW, SetProcessShutdownParameters, GetCurrentThreadId, OpenThreadToken, GetCurrentThread, OpenProcessToken, GetCurrentProcess

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-psapi-obsolete-l1-1-0.dll

K32GetModuleFileNameExW, K32GetModuleBaseNameW, K32EnumProcessModules

api-ms-win-core-registry-l1-1-0.dll

RegOpenKeyExW, RegQueryValueExW, RegCloseKey

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathFileExistsW

api-ms-win-core-string-l1-1-0.dll

CompareStringW

api-ms-win-core-synch-l1-2-0.dll

WaitForSingleObject, OpenEventW, InitializeCriticalSection, WaitForMultipleObjectsEx, Sleep, CreateMutexW, DeleteCriticalSection, EnterCriticalSection, OpenMutexW, SetEvent, LeaveCriticalSection, CreateEventW

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemTimeAsFileTime, GetTickCount, GetTickCount64

api-ms-win-core-threadpool-legacy-l1-1-0.dll

DeleteTimerQueueTimer, CreateTimerQueueTimer, QueueUserWorkItem

api-ms-win-core-version-l1-1-0.dll

GetFileVersionInfoSizeExW, GetFileVersionInfoExW, VerQueryValueW

api-ms-win-security-base-l1-2-0.dll

InitializeAcl, GetSidSubAuthority, EqualSid, CopySid, AddAce, IsValidSid, GetSecurityDescriptorOwner, GetSidLengthRequired, SetSecurityDescriptorOwner, GetSecurityDescriptorGroup, InitializeSid, SetSecurityDescriptorGroup, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, GetAclInformation, GetSecurityDescriptorSacl, GetSecurityDescriptorControl, MakeAbsoluteSD, GetTokenInformation, GetLengthSid, InitializeSecurityDescriptor

kernel32.dll

RegisterApplicationRestart, DelayLoadFailureHook, ResolveDelayLoadedAPI, UnregisterApplicationRestart

msvcrt.dll

DllMain

ntdll.dll

WinSqmAddToStream, EtwEventUnregister, EtwEventWrite, EtwEventRegister, RtlPublishWnfStateData, NtQuerySystemInformation

user32.dll

CharNextW, GetUserObjectInformationW, OpenInputDesktop, CloseDesktop, SetProcessDPIAware, GetSystemMetrics, FindWindowW, SetThreadDesktop, SetWinEventHook, UnhookWinEvent, KillTimer, SendInput, GetWindowThreadProcessId, GetForegroundWindow, GetKeyboardLayout, MapVirtualKeyExW, MapVirtualKeyW, GetDlgCtrlID, GetAncestor, GetWindow, SetTimer, PostMessageW, PostThreadMessageW, DispatchMessageW, GetMessageW, TranslateMessage, GetClassNameW, CharUpperW, UnregisterClassA, GetThreadDesktop

tabtip.exe

Touch Keyboard and Handwriting Panel by Microsoft Corporation (Signed)

Remove tabtip.exe

Version:	6.1.7600.16385 (win7_rtm.090713-1255)
MD5:	21e01fd4147ea1b952e4cd9928b879b8
SHA1:	323a53abba2ecf3e47b3ce53f70bc8ceadb43335
SHA256:	1ddc5bdf16e39ff26aa82b27307ac6ac1ab72368007f7e941486e6b4758272c8

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

tabtip.exe executes as a process with the local user's privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). This is typically installed with the program FoxScanner published by Foxwell. The file is digitally signed by Microsoft Corporation. This version is designed to run on Windows 7 and is compiled as a 32 bit program.

Details

File name:	tabtip.exe
Publisher:	Microsoft Corporation
Product name:	Touch Keyboard and Handwriting Panel
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Program Files\common files\microsoft shared\ink\tabtip.exe
Original name:	TabTip.exe.mui
File version:	6.1.7600.16385 (win7_rtm.090713-1255)
Product version:	6.1.7600.16385
Size:	177.5 KB (181,760 bytes)
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Effective date:	Monday, April 9, 2012
Expiration date:	Tuesday, July 9, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Programs

The following program will install this file

FoxScanner

Foxwell

4% remove

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.01088939%	0.028634%
Kernel CPU:	0.00608272%	0.013761%
User CPU:	0.00480667%	0.014873%
Kernel CPU time:	19,226,835 ms/min	100,923,805ms/min
CPU cycles:	1,008,742/sec	17,470,203/sec
Context switches:	12/sec	284/sec
Memory
Private memory:	5.33 MB	21.59 MB
Private (maximum):	12.41 MB
Private (minimum):	9.39 MB
Non-paged memory:	5.33 MB	21.59 MB
Virtual memory:	80.11 MB	140.96 MB
Virtual memory (peak):	110.2 MB	169.69 MB
Working set:	9.84 MB	18.61 MB
Working set (peak):	15.05 MB	37.95 MB
Page faults:	25,389/min	2,039/min
I/O
I/O read transfer:	66 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	9 Bytes/sec	448.09 KB/min
I/O other operations:	4/sec	1,671/min
Resource allocations
Threads:	16	12
Handles:	268	600
GUI GDI count:	284	103
GUI GDI peak:	305	142
GUI USER count:	72	49
GUI USER peak:	130	71

Process properties

Integrety level:	High
Platform:	32-bit
Command lines:	/quitinfC:00000708;0000079c; /quitinfC:000007dc;00000acc; /manuallaunch /quitinfC:000006d0;000005dc; /quitinfC:0000048c;000004b8; /quitinfC:00000974;00000984; /quitinfC:00000384;000006a0; /manuallaunch /quitinfC:000004a0;000004ac; /manuallaunch (10 more)
Owner:	User
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

ntdll.dll
Total CPU:	1.40191067%	0.272967%
Kernel CPU:	1.21045708%	0.107585%
User CPU:	0.19145359%	0.165382%
CPU cycles:	25,393,217/sec	5,741,424/sec
Memory:	1.23 MB	1.16 MB
msvcrt.dll (Windows NT CRT DLL by Microsoft)
Total CPU:	0.21941013%
Kernel CPU:	0.13778701%
User CPU:	0.08162312%
CPU cycles:	3,919,763/sec
Context switches:	2/sec
Memory:	688 KB
TabTip.exe (main module)
Total CPU:	0.00448327%
Kernel CPU:	0.00335803%
User CPU:	0.00112524%
CPU cycles:	59,383/sec
Memory:	188 KB
gdiplus.dll
Total CPU:	0.00218500%
Kernel CPU:	0.00218500%
User CPU:	0.00000000%
CPU cycles:	37,271/sec
Memory:	1.56 MB
tipskins.dll
Total CPU:	0.00178300%
Kernel CPU:	0.00143015%
User CPU:	0.00035286%
CPU cycles:	22,725/sec
Memory:	864 KB
tabskb.dll
Total CPU:	0.00034471%
Kernel CPU:	0.00019800%
User CPU:	0.00014671%
CPU cycles:	11,951/sec
Memory:	404 KB