Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-10 19:25:02 | 2025-06-10 19:56:01 | 1859 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,162 [root] INFO: Date set to: 20250610T18:32:40, timeout set to: 1800 2025-06-10 19:32:40,143 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-10 19:32:40,143 [root] DEBUG: Storing results at: C:\qDdlkFnGz 2025-06-10 19:32:40,143 [root] DEBUG: Pipe server name: \\.\PIPE\wXevDSJXBA 2025-06-10 19:32:40,143 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-10 19:32:40,143 [root] INFO: analysis running as an admin 2025-06-10 19:32:40,143 [root] INFO: analysis package specified: "exe" 2025-06-10 19:32:40,190 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-10 19:32:41,112 [root] DEBUG: imported analysis package "exe" 2025-06-10 19:32:41,112 [root] DEBUG: initializing analysis package "exe"... 2025-06-10 19:32:41,112 [lib.common.common] INFO: wrapping 2025-06-10 19:32:41,112 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-10 19:32:41,112 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\AccountsControlHost.exe 2025-06-10 19:32:41,112 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-10 19:32:41,112 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-10 19:32:41,112 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-10 19:32:41,112 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-10 19:32:41,316 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-10 19:32:41,346 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-10 19:32:41,362 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-10 19:32:41,440 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-10 19:32:41,487 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-10 19:32:41,487 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-10 19:32:41,487 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-10 19:32:41,503 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-10 19:32:41,503 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-10 19:32:41,503 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-10 19:32:41,503 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-10 19:32:41,503 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-10 19:32:41,503 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-10 19:32:41,503 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-10 19:32:41,503 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-10 19:32:41,503 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-10 19:32:41,503 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-10 19:32:41,503 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-10 19:32:52,815 [modules.auxiliary.digisig] DEBUG: File has a valid signature 2025-06-10 19:32:52,815 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-10 19:32:53,253 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-10 19:32:53,253 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-10 19:32:53,253 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-10 19:32:53,253 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-10 19:32:53,253 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-10 19:32:53,253 [modules.auxiliary.disguise] INFO: Disguising GUID to eebf7374-c733-4252-9a71-d3c91b91d619 2025-06-10 19:32:53,253 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-10 19:32:53,253 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-10 19:32:53,253 [root] DEBUG: attempting to configure 'Human' from data 2025-06-10 19:32:53,253 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-10 19:32:53,253 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-10 19:32:53,253 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-10 19:32:53,253 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-10 19:32:53,253 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-10 19:32:53,253 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-10 19:32:53,253 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-10 19:32:53,253 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-10 19:32:53,253 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-10 19:32:53,253 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-10 19:32:53,269 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-10 19:32:53,269 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-10 19:32:53,269 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-10 19:32:53,269 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-10 19:32:53,284 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-10 19:32:53,284 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-10 19:32:53,300 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\EeGlvdpK.dll, loader C:\tmp_gell1p8\bin\PoaYJsgW.exe 2025-06-10 19:32:53,378 [root] DEBUG: Loader: IAT patching disabled. 2025-06-10 19:32:53,378 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\EeGlvdpK.dll. 2025-06-10 19:32:53,409 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-10 19:32:53,409 [root] INFO: Disabling sleep skipping. 2025-06-10 19:32:53,409 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-10 19:32:53,409 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-10 19:32:53,409 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-10 19:32:53,409 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-10 19:32:53,409 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-10 19:32:53,409 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-10 19:32:53,425 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-10 19:32:53,425 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-10 19:32:53,425 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8234D0000, thread 5112, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-10 19:32:53,425 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-10 19:32:53,440 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-10 19:32:53,440 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-10 19:32:53,440 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\EeGlvdpK.dll. 2025-06-10 19:32:53,440 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025- <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-10 19:25:02 | 2025-06-10 19:55:41 | none |
File Details
| File Name |
AccountsControlHost.exe
|
|---|---|
| File Type | PE32+ executable (GUI) x86-64, for MS Windows |
| File Size | 777232 bytes |
| MD5 | 97a89234629ee0891d970ce29633552a |
| SHA1 | 608fb800461634d70c01057d0d27f16ca8c01b13 |
| SHA256 | fc1ff185db2c960afd5803d5e9b7156fd37261cdebcbce45af9c9768f4e05a58 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 3c8c8c8e93045836f51a216290f39366c2e135926dd2eabd35c6c48a64f5061235d13b7cf5e24fdab6330868feacff43 |
| CRC32 | F5AB0822 |
| TLSH | T159F4C61617DC01D4E6B965384ABA9582FDB2BC150F2182CB01A2571E1F7BAF4BD3D33A |
| Ssdeep | 12288:8D2c9UaT93iz4BljFG+ps/DevAn99J5KkvwesbYdZd67uekzE:S2c95TMz4TjFGQs/DevArJLsba67uzE |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
^1?]8
l$ VWATAVAWH
@.data
CanCallback
WindowsCreateStringReference
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.AccountServiceTypeOptions
Windows.Foundation.Collections.IVector<AccountsControlUI.Models.AccountsDataModel>
DavSyncFrequencySelectedValue
ReleaseMutex
GetStartupInfoW
HeaderText
PA^_^][
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ContactsServer
CreateSemaphoreExW
AccountsControlUI.ViewModels.AccountSettingsViewModel.IsDeleteAccountVisible
Windows.Foundation.IReference`1<AccountsControlUI.ViewModels.ViewType>
u*9Q<|%
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowContactsCalendarSyncOptions
@SVWAVH
AccountsControlUI.Models.AccountsDataModel
AccountsControlUI.ViewModels.AccountSettingsViewModel.ViewSyncSettingsCommand
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.Username
no space on device
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.ShowServerRequiresSsl
IsAccountPolicyDisclosureTextVisible
DoneCommand
not a directory
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.AccountPassword
9Ct|eD
TlP0X
AccountsControlUI.ViewModels.GenericErrorViewModel.ShowSettingsButton
Expanded
AccountsControlUI.ViewModels.AccountsViewModel.ViewType
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
EmailHistorySelectedValue
api-ms-win-core-string-l1-1-0.dll
System.Enum
VWAVH
PA_A^A]A\_^[
system
O0M0K
Microsoft Corporation
ShowContactsCalendarSyncOptions
Ad:\os\src\shellcommon\shell\accountscontrol\app\host\app.xaml.cpp
fD9,Qu
memcmp
ShowChooseClientAuthCertificate
_XcptFilter
.u$H;3
_lock
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
EmailHistoryOptions
AccountsControlUI.ViewModels.ImportAccountsViewModel.IsPageDescriptionVisible
gH9QPtv8QLu.H
RoReportUnhandledError
@SUVWAVH
IncomingServer
AccountsControlUI.ViewModels.AccountSettingsViewModel.Username
.?AU__I?$Array@PE$AAVString@Platform@@$00PublicNonVirtuals@Platform@@
.?AUIWeakReferenceSource@Details@Platform@@
WebAccountId
.data$r
resource unavailable try again
_initterm
AccountsControlUI.ViewModels.AllDoneViewModel.AllDoneDescriptionText
.?AVlogic_error@std@@
.idata$5
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.IsAccountPolicyDisclosureTextVisible
not connected
.CRT$XIYA
L$ H;L$(t
protocol_not_supported
A_A]A\_^
AccountsControlUI.ViewModels.AccountSettingsViewModel.AutoChooseClientAuthCertificate
.pdata
Microsoft
AccountsControlUI.ViewModels.AccountSettingsViewModel.EmailAddress
SetRestrictedErrorInfo
Scheduler is already initialized
NtQueryWnfStateData
L$ Lc
_acmdln
AccountsControlUI.ViewModels.AccountsViewModel.UserPicture
operation_in_progress
@UVWAVAWH
C @8}
t#E9V0t
\$H@2
.CRT$XIYB
AccountsControlUI.ViewModels.AccountsViewModel.Links
_get_current_locale
IsCreateAccountFlow
host_unreachable
regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified character sequence.
&3Kr-j
L$0H;L$8t%
AccountsControlUI.ViewModels.AADViewModel.AADNeedCredentialsTitleText
connection refused
read only file system
.PE$AAVFailureException@Platform@@
_exit
XamlTypeInfo.InfoProvider.XamlTypeInfoProvider
operation would block
0A^_^
OutgoingServerRequiresSsl
Windows.Foundation.IReference`1<Int32>
Legal_Policy_Statement
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerAccountPassword
AccountsControlUI.ViewModels.AccountsViewModel.ExistingAccountTitle
Windows.Globalization.ApplicationLanguages
%hs!%p:
.PE$AAVInvalidArgumentException@Platform@@
K SVWH
0A_A^A\_^
AccountsControlUI.ViewModels.AccountSettingsViewModel.ShowSelectedClientAuthCertificate
CoCreateFreeThreadedMarshaler
p WAVAWH
uc8X$t
ActivityStoppedAutomatically
.?AU__I?$WriteOnlyArray@PE$AAVString@Platform@@$00PublicNonVirtuals@Platform@@
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncCalendar
AccountsControlUI.ViewModels.MSAViewModel
AccountsControlHost.pdb
AccountsControlUI.ViewModels.AccountsViewModel.NeedMoreCharacters
AccountsControlUI.ViewModels.AccountsViewModel.SystemProvidedAccounts
L$ H;L$(t/D9I
GetStringTypeW
??0ChangedStateException@Platform@@QE$AAA@XZ
.PE$AAUIDisposable@Platform@@
Microsoft Time-Stamp PCA 20100
9\u=H
AccountsControlUI.ViewModels.AccountSettingsViewModel.CancelCommand
WilStaging_02
argument out of domain
.rdata$r
f9,Ku
`A^_^
Windows.Foundation.IReference`1<AccountsControlUI.Models.AccountPropertiesType>
$L;0u*H
NextCommandEnabled
ShowPicture
.CRT$XIA
Windows.UI.ApplicationSettings.SupportedWebAccountActions
180823202627Z
AccountsControlUI.ViewModels.AccountSettingsViewModel.PageTitle
111019184142Z
AllDoneDescriptionText
api-ms-win-core-rtlsupport-l1-1-0.dll
hA_A^A]A\_^][
AccountsControlUI.ViewModels.AccountsViewModel.Searching
connection_already_in_progress
generic
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
\$ VWATAVAWH
x UAVAWH
E`D+EXD
IsAutoConfigTryAgainInfoTextVisible
FileDescription
%Microsoft Windows Production PCA 2011
\$ UVWH
GetLocaleInfoEx
AccountsControlUI.ViewModels.ViewModelBase.ViewEnabled
AccountsControlUI.ViewModels.SyncSettingsViewModel.IsSyncEmailEnabled
YourName
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
Title
\$ VWAVH
Microsoft Corporation1
UWATAVAWH
.PE$AAVNullReferenceException@Platform@@
RtlSubscribeWnfStateChangeNotification
Microsoft Operations Puerto Rico1&0$
ContinueCommand
AccountsControlUI.ViewModels.AccountsViewModel.CanCallback
no stream resources
AccountsControlUI.ViewModels.AccountsViewModel.AccountsToBeAdded
10.0.17763.1
directory not empty
DisplayPurpose
A_A^A\_^
Microsoft Time-Stamp PCA 2010
ManageButtonText
regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression.
d:\os\public\amd64fre\internal\sdk\inc\wil\staging.h
IncomingServerRequiresSsl
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.AccountTypeTitle
network reset
AccountsControlUI.ViewModels.ViewModelBase
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.OutgoingServerUseSameUsernamePassword
Boolean
System.ValueType
D$(E3
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.SignInCommand
BubbleHeadAccountTitle
message
no protocol option
originatingContextName
.?AVruntime_error@std@@
0A_A^_^]
<P)9Y
Windows.Security.Credentials.WebAccountState
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.Username
.PE$AAVChangedStateException@Platform@@
arguments
IsSyncFrequencyBasedOnUsage
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncEmail
@8yXt
upper
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.AccountTypeTitle
;Q(s!
f9<^u
memmove_s
AccountsControlUI.Models.AccountsDataModel.ShowDefaultIcon
.rdata$zETW9
no buffer space
Windows.UI.Xaml.Input.ICommand
UVWAVAWH
AccountsControlUI.ViewModels.AccountSettingsViewModel.ChooseCertificateCommand
L$0E3
D$HH9
AccountsControlUI.ViewModels.AccountsViewModel.IsBubbleHeadAccountSelected
;0n+R
L$8H3
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel
??0OutOfBoundsException@Platform@@QE$AAA@XZ
AccountsControlUI.Models.AccountsDataModel.DisplayPurpose
Windows.Foundation.IReference`1<Guid>
A_A^A\_]
H;L$(u
AccountsControlUI.ViewModels.ViewModelBase.ProgressTextHelper
100701213655Z
vector<bool> too long
AccountsControlUI.ViewModels.YahooOAuthViewModel.IsCreateAccountFlow
OutgoingServerUsername
DllCanUnloadNow
RoOriginateError
TerminateProcess
minATL$__m
AccountsControlUI.ViewModels.InvalidServerCertViewModel
f9,Au
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel
___mb_cur_max_func
HcF$M
AccountsControlUI.ViewModels.InvalidServerCertViewModel.CancelCommand
Server
DeleteCommand
Object
\$ A;
sntdll.dll
OutgoingServerRequiresAuth
ShowProgressBar
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
Microsoft Windows0
AADNeedCredentialsPageDescriptionText
bad_address
AccountsControlUI.Models.AccountsDataModel.WebAccountId
ShowUserPicture
PA_A^A\_^
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
.text$x
R!s4Z
not_connected
too many links
$0< u=3
|$@H!|$8
AccountsControlUI.ViewModels.AccountsViewModel.BubbleHeadAccountTitle
regex_error(error_badbrace): The expression contained an invalid range in a { expression }.
AccountsControlUI.ViewModels.AccountsViewModel.AccessDenied
blank
.xdata$x
L$HH3
A^_^
GetModuleHandleW
H;D$8u
inappropriate io control operation
.?AVregex_error@std@@
AccountsControlUI.ViewModels.SelectAccountTypeViewModel.AccountTypeSelectedCommand
.giats
kernelbase.dll
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
connection reset
A_A^A\_^][
api-ms-win-core-winrt-error-l1-1-0.dll
connection aborted
ViewEnabled
OriginalFilename
.?AU__abi_Module@@
AccountsControlUI.ViewModels.ExchangeAuthTypeDiscoveryViewModel.NextCommand
destination_address_required
.?AU__abi_IUnknown@@
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
L$0fD
$Microsoft Ireland Operations Limited1
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerUsesPassword
fD94Au
___lc_handle_func
\$8E3
DeleteAccountCommand
PreviousExecutionState
D9yL|
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.CancelCommand
AccountsControlUI.ViewModels.AllDoneViewModel
UVWATAUAVAWH
NtUpdateWnfStateData
CloseHandle
L$8E3
@.reloc
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel
{|?uXH
AccountsControlUI.Views.BubbleHeadView
z.9Wv
_purecall
9\uBH
timed_out
GetSystemTimeAsFileTime
failureCount
E8=csm
ShowClientAuthCertificateControls
@85rD
___lc_codepage_func
h_^][
E(=csm
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
Windows.Foundation.IReferenceArray`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
??0exception@@QEAA@AEBQEBDH@Z
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowAdvancedSettingsOption
DownloadAllEmailContentsText
SetUnhandledExceptionFilter
network down
NeedMoreAccounts
executable format error
AccountsControlUI.ViewModels.ExchangeAuthTypeDiscoveryViewModel
\$hE3
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.OutgoingServerAccountPassword
D$ E3
.text
AccountName
AccountsControlUI.ViewModels.DeleteAccountViewModel.IconBitmap
AccountsControlUI.ViewModels.AccountsViewModel.SupportedProviders
.PE$AAVOutOfBoundsException@Platform@@
D9l$hA
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties
IsBubbleHeadAccountAvailable
f9Axu`
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
originatingContextId
WAUAVH
RelatedTelemetryId
L$`E3
AccountsControlUI.ViewModels.ImportAccountsViewModel
cntrl
A^A]_
?__abi_WinRTraiseChangedStateException@@YAXXZ
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.IsSslRequiredForOutgoingServer
t"D8=cH
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.OutgoingServer
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.CancelCommand
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.AccountName
.idata$4
AccountsControlUI.ViewModels.AccountsViewModel.EditBoxPlaceHolderText
regex_error(error_collate): The expression contained an invalid collating element name.
??0OutOfMemoryException@Platform@@QE$AAA@XZ
;t$p|
.PE$AAVNotImplementedException@Platform@@
`A_A^A]A\_^[
__dllonexit
T$pL;L$`u
AccountsControlUI.ViewModels.SelectAccountTypeViewModel.CancelCommand
connection_aborted
identifier removed
regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings.
Windows.UI.Xaml.DependencyObject
.?AVbad_cast@@
9\uJH
operation not supported
api-ms-win-core-com-l1-1-0.dll
cross device link
AccountsControlUI.ViewModels.AccountsViewModel.ShowNoResultFoundInfo
\$ UVWAVH
fD91t
H;D$(t2H
Windows.Foundation.IReference`1<Windows.UI.ApplicationSettings.SupportedWebAccountActions>
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.Username
__C_specific_handler
AccountsControlUI.ViewModels.ViewModelBase.CommandInProgress
0A_A^A]A\_^]
std::exception: %hs
PromptForPasswordText
no link
(D$@f
AccountsControlUI.ViewModels.GoogleOAuthViewModel
AccountsControlUI.Views.MainPage
_m l6
|$ AVH
IsSslRequiredForIncomingServer
bad allocation
SelectedAccountServiceTypeIndex
.text$mn$00
t$ WH
SetLastError
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowRequireSslFields
.rsrc$01
SupportedProviders
CallContext:[%hs]
DebugBreak
AccountsControlUI.ViewModels.ExchangeAuthTypeDiscoveryViewModel.AccountTypeTitle
8XLu.H
AccountsControlUI.ViewModels.YourEmailDisplayNameViewModel.SignInCommand
EH=csm
A_A^A]
{R6me
AccountsControlUI.ViewModels.DeleteAccountViewModel.EmailAddress
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.SignInCommandText
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.OutgoingServerUsername
SavedAccounts
AccountsControlUI.Models.AccountsDataModel.AutomationName
AccountsControlHostLaunched
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
L9d$(t5L
AccountsControlUI.ViewModels.AccountSettingsViewModel.DeleteAccountCommand
AccountsControlUI.Models.AccountsDataModel.Provider
C$9C w"H
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.EmailAddress
api-ms-win-core-util-l1-1-0.dll
permission_denied
3YWu!
AccountsControlUI.Models.AccountsDataModel.ManageButtonText
_CxxThrowException
t+fE91t%L
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.IsSslRequiredForIncomingServer
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.AccountPassword
SignInCommandText
AccountsControlUI.ViewModels.AccountsViewModel.HeaderText
LeaveCriticalSection
resource deadlock would occur
IsDavSyncFrequencyEnabled
too many files open in system
L$ SVWH
D9l$@}'H
address not available
Microsoft Corporation1)0'
AccountsControlUI.ViewModels.AccountsViewModel.Title
Microsoft Corporation. All rights reserved.
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
NeedMoreCharacters
.?AVexception@@
callContext
L$PH3
message size
AccountTypeSelectedCommand
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
@A^_^][
.text$yd
bad cast
AccountsControlUI.ViewModels.SyncSettingsViewModel.PageTitle
AccountsControlUI.ViewModels.AccountsViewModel.ShowAccessDenyInfo
api-ms-win-core-localization-l1-2-0.dll
PA_A^_^]
LcA<E3
AccountsControlUI.ViewModels.SyncSettingsViewModel.IsSyncFrequencyBasedOnUsage
AccountsControlUI.ViewModels.GenericErrorViewModel.ErrorCode
AccountPassword
AccountsControlUI.ViewModels.GenericErrorViewModel
ExistingAccountTitle
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
|$0I9
@.rsrc
AccountsControlUI.ViewModels.AADViewModel
^|H;N
AccountsControlUI.ViewModels.InvalidServerCertViewModel.ContinueCommand
AcquireSRWLockExclusive
OutgoingServerAccountPassword
PageTitle
AccountsControlUI.ViewModels.AccountsViewModel.IsSupportedProviderAvailable
`A_A^A]A\_^]
?UninitializeData@Details@Platform@@YAXH@Z
SyncFrequencyDescription
protocol not supported
AccountsControlUI.ViewModels.SyncSettingsViewModelFactory
IsSslRequiredForOutgoingServer
LegalCopyright
launchArgs
9D$tuYH
function
xdigit
@8yxt
9\uCH
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.IsSignInInfoTextVisible
ShowOutgoingServerCredentials
191123202627Z0
H;|$(u
NeedAttention
M0K0I
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
D$HH;
L$0H3
[ UVWH
Actions
AccountsControlUI.ViewModels.AccountSettingsViewModel.SyncSettingsTextButtonAutomationName
alpha
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.AdvancedMailBoxSettingsSubtitle
wilActivity
AccountTypeTitle
fD9<Bu
ShowAdvancedSettingsOption
AccountsControlUI.ViewModels.InvalidServerCertViewModel.Description
.rdata$zzzdbg
_vsnprintf_s
.?AVInProcModule@Details@Platform@@
WAVAWH
:\u:L
realloc
.rdata
AccountsControlHost.App
??1type_info@@UEAA@XZ
??0exception@@QEAA@XZ
api-ms-win-core-errorhandling-l1-1-0.dll
CT$8L
too many files open
AccountsControlUI.ViewModels.GenericErrorViewModel.CloseButtonText
D;{ }*E
minATL$__a
IsSyncEmailEnabled
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
tGf9)u;H
wcsstr
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncFrequencyOptions
no lock available
D$$I;
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.AccountTypeTitle
:cY7.u!
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncContacts
AccountsControlUI.ViewModels.AccountSettingsViewModel.AccountName
Provider
?__abi_WinRTraiseNullReferenceException@@YAXXZ
%Microsoft Windows Production PCA 20110
WaitForSingleObject
address in use
GetModuleFileNameA
PA_A^A\_^[]
SVWATAUAVAWH
owner dead
0A_A^A\
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncFrequencySelectedValue
print
IsDavAccount
network unreachable
api-ms-win-core-sysinfo-l1-1-0.dll
memcpy
.idata$3
WindowsIsStringEmpty
261019185142Z0
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
invalid seek
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.SignInCommand
AccountsControlUI.ViewModels.AccountsViewModel
AccountsControlUI.ViewModels.AllDoneViewModel.EmailAddress
{xauQ
DavSyncFrequencyOptions
H!|$8H
is a directory
RtlDllShutdownInProgress
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.YourName
punct
string too long
"Microsoft Window
Accounts Control Host
??0bad_cast@@QEAA@PEBD@Z
NewAccountTitle
no child process
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowAdvancedSettingsCommand
Windows.Security.Credentials.WebAccountProvider
(_^][
D;} }XI
__setusermatherr
ShowDefaultIcon
UATAUAVAWH
HeapFree
invalid string position
9\u5L
no message available
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
currentContextId
GetTickCount
fA96u
Thales TSS ESN:7D2E-3782-B0F71%0#
.CRT$XIY
L$@H3
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.IncomingServer
/DxJ)
Windows.UI.Xaml.Markup.IXamlType
T$`E3
UWAVH
regex_error(error_parse)
E9w ~/L
MultiByteToWideChar
\$hI;
State
AccessDenied
@VWAVH
connection_reset
EventSetInformation
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a
??1bad_cast@@UEAA@XZ
UWAUAVAWH
AccountsControlUI.Models.AccountPropertiesType
OutputDebugStringW
CtH;K
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncFrequencyDescriptionHelpText
stoi argument out of range
@SVWAVAWH
AccountsControlUI.Models.AccountsDataModel.Collapsed
ReturnHr
AccountsControlUI.ViewModels.AccountSettingsViewModel.Icon
D$0H9
AccountsControlUI.accountscontrolui_XamlTypeInfo.XamlMetaDataProvider
EmailAddress
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.SyncCalendar
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.EmailAddress
AccountsControlUI.ViewModels.AccountsViewModel.BubbleHeadAccounts
space
_ismbblead
AccountsControlUI.ViewModels.GenericErrorViewModel.Title
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.Domain
A^_^[
AccountsControlUI.ViewModels.AccountsViewModel.ShowScrollViewer
AccountsControlUI.Models.AccountsDataModel.UPN
@8,1u
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.SignInErrorDescription
@SUVWATAVAWH
WATAUAVAWH
SUVWH
EditBoxPlaceHolderText
fD9t]
$`2X`F
E90t4
.?AV?$WriteOnlyArray@PE$AAVString@Platform@@$00@Platform@@
tvA;_(siI
.PE$AAUIPrintable@Details@Platform@@
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerRequiresSsl
IsSystemProvidedAccountAvailable
A_A^A]A\_
.CRT$XCAA
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
Platform.?$WriteOnlyArray@PE$AAVString@Platform@@$00
fD98u
Windows.Foundation.PropertyValue
ReleaseSRWLockShared
\$ UH
D$xH!D$0L
connection already in progress
no message
L9{0t#H
.00cfg
AccountsControlUI.ViewModels.SelectAccountTypeViewModel.SelectedAccountType
^\s+|\s*,\s*|\s+$
SyncContacts
@SUVWH
Error
FailFast
T$0E3
http://www.microsoft.com/windows0
ChooseAccount
ATAVAWH
AccountsControlUI.ViewModels.AccountSettingsViewModel.IsAccountSyncing
CompanyName
AccountsControlUI.ViewModels.SyncSettingsViewModel.SyncFrequencyDescription
GetCurrentThreadId
@A_A^_
}0H+}(H
AccountsControlUI.Models.AccountsDataModel.IsAADAccount
__getmainargs
WaitForThreadpoolTimerCallbacks
IconBitmap
AccountsControlUI.ViewModels.AccountsViewModel.NeedMoreAccounts
Platform.?$WriteOnlyArray@VXmlnsDefinition@Markup@Xaml@UI@Windows@@$00
u HcA<H
InternetMail
@SVWATAUAVAWH
AccountsControlUI.ViewModels.YourEmailDisplayNameViewModel.CancelCommand
calloc
ShowAccessDenyInfo
L$HM;
message_size
GetProcessHeap
SelectedBubbleHeadItem
AutomationName
Sleep
20180916002813Z0w0=
AccountsControlUI.ViewModels.SyncSettingsViewModel.CurrentlySyncingDescription
.PE$AAVObject@Platform@@
AccountsControlUI.ViewModels.AADViewModel.NextCommand
t$ UWATAVAWH
AccountsControlUI.ViewModels.AllDoneViewModel.IsMailSyncMessageVisible
Ipbad locale name
IsDeleteAccountVisible
@SUVWAVAWH
jcY7.
T$0H+
value too large
AccountsControlUI.Models.AccountsDataModel.AutomationId
NextCommand
)Microsoft Root Certificate Authority 20100
WindowsGetStringLen
H9_Hs<
ReleaseSemaphore
DD$@H
network_unreachable
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.AccountInfoSavedText
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.Server
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
L$HH;L$Pt!A
PA_A^A]A\_^]
l$ VWAVH
?what@exception@@UEBAPEBDXZ
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.ServerRequiresSsl
CloseThreadpoolTimer
SelectedItemChooseAccount
(null Message)
L$ SUVWH
td@853D
G L;'u
not supported
|hK,_
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel
??0exception@@QEAA@AEBQEBD@Z
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.AccountName
wcsrchr
AccountsControlUI.ViewModels.AccountsViewModel.SelectedItemSavedAccount
CanNavigateBack
AccountsControlUI.ViewModels.FixPasswordViewModel.SaveCommand
AccountsControlUI.ViewModels.FixPasswordViewModel.AccountPassword
D$PE3
network_down
CA^_^]
?__abi_WinRTraiseNotImplementedException@@YAXXZ
memmove
?__abi_FailFast@@YAXXZ
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
ErrorCode
(caller: %p)
IsIdpSettingsVisible
?__abi_WinRTraiseDisconnectedException@@YAXXZ
L$PH;
interrupted
strchr
_callnewh
lower
250701214655Z0|1
SyncFrequencyTitle
__set_app_type
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowOutgoingServerCredentials
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.IncomingServerRequiresSsl
AccountsControlUI.ViewModels.GenericErrorViewModel.IsErrorCodeAvailable
040904B0
D9w tJH
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel
.rdata$zETW2
Windows.Foundation.IReferenceArray`1<String>
regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine.
wcstol
Windows.Foundation.Collections.IIterator`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
wcslen
229879+4379540
AccountsControlUI.ViewModels.AccountsViewModel.IsBubbleHeadAccountAvailable
AccountsControlHost
@USVWAVH
wrong_protocol_type
too many symbolic link levels
not enough memory
AcquireSRWLockShared
WindowsDeleteString
|$0I;
HcA<H
__crtLCMapStringW
H9QPtc8QLu.H
.?AVbad_alloc@std@@
A_A^A]A\_^]
AccountsControlUI.ViewModels.AccountsViewModel.NewAccountTitle
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.EmailAddress
AccountsControlUI.ViewModels.AccountsViewModel.IsSystemProvidedAccountAvailable
A_A^]
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.AccountPassword
Windows.UI.Xaml.Application
ContactsServer
filename_too_long
AccountsControlUI.ViewModels.AccountsViewModel.ShowUserPicture
InitOnceComplete
AccountsControlUI.ViewModels.ViewType
ViewIdpSettingsCommand
DllGetActivationFactory
AccountsControlUI.ViewModels.AccountSettingsViewModel.SaveCommand
f9)uBH
Microsoft.Windows.Shell.AccountsControl
Domain
operation_would_block
WideCharToMultiByte
AutomationId
@SVWH
A_A^_^[
VWAUAVAWH
AccountsControlUI.ViewModels.SyncSettingsViewModel.CurrentlySyncingLabel
VarFileInfo
DownloadAllEmailContents
_fmode
no such file or directory
tMfD91u@H
Links
Eh=csm
TUUUUUU
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowSyncFrequencyDescription
()$^.*+?[]|\-{},:=!
ShowScrollViewer
AccountsControlUI.Common.AccountsControlFrame
_vsnwprintf
AccountsControlUI.ViewModels.DeleteAccountViewModel
api-ms-win-core-libraryloader-l1-2-0.dll
RtlUnsubscribeWnfNotificationWaitForCompletion
D9z4u
AccountsControlHost.exe
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
ViewSyncSettingsCommand
IsMailSyncMessageVisible
D$T9p
AccountsControlUI.ViewModels.AccountSettingsViewModel.ClientAuthCertificateIssuer
AccountsControlUI.ViewModels.AccountSettingsViewModel.IsIdpSettingsVisible
AccountShareApprovalText
F0D8#ukD8c
Local\SM0:%d:%d:%hs
address family not supported
D8mxtKL
A^_^][
AccountsControlUI.ViewModels.AccountSettingsViewModel.ClientAuthCertificateIssuedTo
stream timeout
T$(L+)3
api-ms-win-core-winrt-string-l1-1-0.dll
FormatMessageW
AccountsControl
module
regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level.
AdvancedMailBoxSettingsSubtitle
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
@WAVAWH
Platform.?$WriteOnlyArray@PE$AAUIXamlMetadataProvider@Markup@Xaml@UI@Windows@@$00
gEsFvB
A_A^A]A\_
D$@fD
10.0.17763.1 (WinBuild.160101.0800)
D9&tZA
DeleteCriticalSection
\$ WH
RtlCaptureContext
minATL$__z
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.ShowOutgoingServerCredentials
AccountsControlUI.ViewModels.AccountsViewModel.IsLinkAvailable
x ATAVAWH
regex_error(error_syntax)
io error
t{HcL$ HcD$$H
ARich}a
AccountsControlUI.ViewModels.AccountSettingsViewModel.IconBitmap
.?AV?$Module@$04VInProcModule@Details@Platform@@@WRL@Microsoft@@
operation canceled
AccountsControlUI.ViewModels.GenericErrorViewModel.CancelCommand
9{tu"
ShouldBlockProviders
A_A^_
f#D$@H
Connected
Microsoft Corporation1200
AccountsControlUI.Models.AccountsDataModel.State
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
d$HfD
ActivityError
Washington1
regex_error(error_backref): The expression contained an invalid back reference.
CH}#6%
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.IsDavSyncFrequencyEnabled
A_A^A\
?__abi_WinRTraiseFailureException@@YAXXZ
AccountsControlUI.Models.AccountsDataModel.Type
SystemProvidedAccounts
D$0H;
ShowSyncFrequencyDescription
invalid_argument
api-ms-win-core-threadpool-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
Windows.Foundation.IReference`1<Boolean>
SignInErrorDescription
@USVWATAVAWH
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.AccountPassword
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.Icon
A_A^A]_^
t6D8l$
ReleaseSRWLockExclusive
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
AccountsControlUI.ViewModels.YahooOAuthViewModel
AccountsControlUI.Views.SavedAccountsView_FixHassles
D9d$H}7L
t>y&H
RtlLookupFunctionEntry
.8SLu
[%hs(%hs)]
SettingsCommand
ShowDefaultUserIcon
ServerRequiresSsl
QueryPerformanceCounter
.PE$AAUIEquatable@Details@Platform@@
regex_error(error_ctype): The expression contained an invalid character class name.
??0FailureException@Platform@@QE$AAA@XZ
threadId
t$0E3
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.ShowPasswordInputField
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.CancelCommand
msvcrt.dll
\$ UVWATAUAVAWH
StringFileInfo
0A_A^A]A\_
api-ms-win-core-handle-l1-1-0.dll
ViewDetails
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
.?AVModuleBase@Details@WRL@Microsoft@@
@8ypt
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.AccountName
AccountsControlUI.Models.AccountsDataModel.Expanded
already_connected
AccountsControlUI.ViewModels.YourEmailDisplayNameViewModel
.text$mn
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
broken pipe
D$XE3
AccountsControlUI.ViewModels.AccountsViewModel.ShouldBlockProviders
;M$|DI
\$@L+
failureId
setlocale
AccountsControlUI.ViewModels.AccountsViewModel.SelectedBubbleHeadItem
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.DavSyncFrequencySelectedValue
protocol error
CreateFrame
CloseButtonText
tH9XPu
text file busy
d:\os\public\amd64fre\internal\sdk\inc\wil\resource.h
DecodePointer
EventWriteTransfer
IsSignInInfoTextVisible
Microsoft Operations Puerto Rico1'0%
AccountsControlUI.ViewModels.ImportAccountsViewModel.ImportedAccounts
?InitializeData@Details@Platform@@YAJH@Z
20180915013050.549Z0
L$`H3
address_family_not_supported
D$@E3
@A_A^_^[
?__abi_WinRTraiseCOMException@@YAXJ@Z
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.EmailAddress
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
Windows.Foundation.Collections.IObservableVector`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
WindowsGetStringRawBuffer
UserPicture
timed out
8A^_^[
H!~(H!~0H!~8H!~@3
IsDebuggerPresent
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
tAy&H
EventActivityIdControl
HA_A^A]A\_^][
`A_A^A\_^
iSHp6
.rdata$zETW1
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.Domain
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.CalendarServer
??1exception@@UEAA@XZ
AccountsControlUI.ViewModels.SelectAccountTypeViewModel
permission denied
RtlVirtualUnwind
NoResultFound
EX=csm
??3@YAXPEAX@Z
RaiseFailFastException
state not recoverable
AccountsControlUI.Views.ChooseAccountView_FixHassles
regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape.
Collapsed
Ex=csm
.CRT$XCA
.PEAX
E9V0u
.PE$AAVCOMException@Platform@@
IsLinkAvailable
AccountsControlUI.ViewModels.DelayedTextHelper
IsAccountAuthTypeBasic
AccountsControlUI.ViewModels.FixPasswordViewModel.UsernameEditable
SetThreadpoolTimer
fD90t,
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
SelectedItemSavedAccount
AccountsControlUI.ViewModels.FixPasswordViewModel.EmailAddress
UnhandledExceptionFilter
9\u5H
operation in progress
EventUnregister
AccountInfoSavedText
U0S0Q
Microsoft Time-Stamp Service0
AccountsControlUI.ViewModels.EmailPasswordSignInViewModel.IsAutoConfigTryAgainInfoTextVisible
t>y#H
currentContextName
ViewType
C9fD9?u-
RtlNtStatusToDosErrorNoTeb
@SUVWATAUAVAWH
_free_locale
Int32
VS_VERSION_INFO
ActiveSync
AccountsControlUI.ViewModels.AccountSettingsViewModel.ViewIdpSettingsCommand
SyncCalendar
api-ms-win-core-synch-l1-2-0.dll
Windows.Foundation.IReference`1<AccountsControlUI.Models.ItemType>
|$ M;
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
A_A^_^]
filename too long
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
.CRT$XCZ
digit
map/set<T> too long
currentContextMessage
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.OutgoingServerRequiresAuth
Exception
AccountsControlUI.Common.MCCSUIFrame
AccountsControlUI.ViewModels.FixPasswordViewModel.Username
too_many_files_open
RoFailFastWithErrorContext
.?AV?$Module@$00VInProcModule@Details@Platform@@@WRL@Microsoft@@
.data
AccountsControlUI.ViewModels.GenericErrorViewModel.Description
nCipher NTS ESN:57F6-C1E0-554C1+0)
AccountsControlUI.ViewModels.SyncSettingsViewModel.CancelCommand
device or resource busy
memset
_XamlTypeInfo.InfoProvider.XamlMember
[%hs]
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.SelectedAccountServiceTypeIndex
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
unknown error
result out of range
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.IncomingServer
XamlTypeInfo.InfoProvider.XamlSystemBaseType
\$ UVWAVAWH
GetProcAddress
BubbleHead
OutgoingServer
ProductName
PH;L$(u
.PE$AAVException@Platform@@
Microsoft Corporation1.0,
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
t$@L;
.idata$6
Username
api-ms-win-core-heap-l1-1-0.dll
AccountsControlUI.Models.AccountsDataModel.Actions
no such process
ActivityIntermediateStop
IsBubbleHeadAccountSelected
IsAADAccount
Microsoft Time-Stamp Service
L$ Mc
AccountsControlUI.ViewModels.FixPasswordViewModel.Icon
@A_A^_^]
AccountsControlUI.ViewModels.AccountsViewModel.NoResultFound
Windows.Foundation.IReference`1<Windows.Security.Credentials.WebAccountState>
D$HE3
H;0u'L
AccountsControlUI.Models.AccountsDataModel.IsExpanded
wincorlib.DLL
ChooseCertificateCommand
CancelCommand
not_a_socket
AccountsControlUI.ViewModels.FixPasswordViewModel.CancelCommand
.CRT$XCC
bad_file_descriptor
t]fD9#tWH
__pctype_func
PA^_^
CHD1p
FileVersion
AccountsControlUI.Models.ItemType
AccountsControlUI.ViewModels.SyncSettingsViewModel.EmailHistorySelectedValue
cY7.L
L$hH3
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
.?AVlength_error@std@@
Microsoft Corporation1&0$
SVWAVH
p AWH
1(0&0
Windows.UI.Xaml.Media.Imaging.BitmapImage
180703204550Z
regex_error(error_brace): The expression contained mismatched { and }.
t$HL+7I
WindowsConcatString
wilResult
DD$XH
bad address
memcpy_s
operation not permitted
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.EmailAddress
USVWATAVAWH
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
0A_A^_^[
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.AutomationName
?__abi_WinRTraiseInvalidCastException@@YAXXZ
Platform::Exception^: %ws
xA_A^A]A\_^[]
.?AUIDisposable@Platform@@
Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0
AccountsControlUI.ViewModels.DeleteAccountViewModel.CancelCommand
WindowsCreateString
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.ShowContactsCalendarSyncOptions
CoTaskMemAlloc
ShowNoResultFoundInfo
@UVWATAUAVAWH
CreateMutexExW
L$XL+
Windows.Foundation.Collections.IVectorChangedEventArgs
EventRegister
_wcsdup
AccountsControlUI.ViewModels.DelayedTextHelper.ProgressText
D9d$H}=L
@UVWH
D9d$H
A_A^_^]
AccountsControlUI.ViewModels.SyncSettingsViewModel
AccountsControlUI.ViewModels.AccountsViewModel.CanNavigateBack
.?AVout_of_range@std@@
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.SignInCommand
HeapAlloc
A_A^A\_^
0A__^
destination address required
DifferentAccountTitle
SVWAVAWH
CurrentlySyncingDescription
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServer
AccountsControlUI.Models.AccountsDataModel.DisplayName
Description
file exists
AutoChooseClientAuthCertificate
H3E H3E
InternalName
malloc
AccountsControlUI.ViewModels.AccountSettingsViewModel.IsAccountAuthTypeBasic
9\u<H
VSDesignerDllMain
AccountsControlUI.ViewModels.AccountsViewModel.Description
api-ms-win-core-profile-l1-1-0.dll
.rsrc$02
D$@H!|$@D
_unlock
iostream
ShowAdvancedSettingsCommand
Platform.Guid
wrong protocol type
DisplayName
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.YourName
CalendarServer
AccountServiceTypeOptions
String
H98u2H
AccountShareApproval
.text$di
58_Lu
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
IsAccountSyncing
.edata
originatingContextMessage
VWATAVAWH
AccountsControlUI.ViewModels.AccountsViewModel.ShowProgressBar
D8"u3H
bad message
L$(H3
"Microsoft Time Source Master Clock0
GetCurrentProcessId
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.ShowSyncFrequencyDescription
L$XH3
I0G1-0+
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.ShowAdvancedFields
??0InvalidArgumentException@Platform@@QE$AAA@XZ
@8y@t
.rdata$zETW0
argument list too long
CreateThreadpoolTimer
AccountsControlUI.Models.AccountsDataModel.Icon
host unreachable
Windows.Foundation.Collections.IObservableVector<AccountsControlUI.Models.AccountsDataModel>
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
AccountsControlUI.ViewModels.AccountSettingsViewModel.AccountPassword
network_reset
.?AUIValueType@Platform@@
@8yht
WaitForSingleObjectEx
AccountsControlUI.ViewModels.AccountSettingsViewModel
regex_error
iostream stream error
Windows.UI.Xaml.Window
QueryResultAccounts
??0Object@Platform@@QE$AAA@XZ
AccountsControlUI.ViewModels.SyncSettingsViewModel.DownloadAllEmailContents
bad file descriptor
WindowsDuplicateString
IsSupportedProviderAvailable
regex_error(error_paren): The expression contained mismatched ( and ).
AccountsControlUI.ViewModels.SyncSettingsViewModel.EmailHistoryOptions
no such device or address
AccountsControlUI.ViewModels.GenericErrorViewModel.SettingsCommand
AccountsControlUI.Common.Utilities
@USVWH
CoTaskMemFree
SyncFrequencyOptions
rMfD9?w
AccountsControlUI.ViewModels.ImportAccountsViewModel.DoneCommand
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.DavSyncFrequencyOptions
.CRT$XIZ
address_in_use
.?AVinvalid_argument@std@@
AccountsControlUI.ViewModels.ExchangeAuthTypeDiscoveryViewModel.CancelCommand
ShowServerRequiresSsl
abort
SyncFrequencyDescriptionHelpText
ShowAdvancedFields
InitializeCriticalSectionEx
EncodePointer
!This program cannot be run in DOS mode.
Msg:[%ws]
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerUseSameUsernamePassword
@A^_^
already connected
api-ms-win-eventing-provider-l1-1-0.dll
AccountsControlUI.ViewModels.AccountSettingsViewModel.ShowClientAuthCertificateControls
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.SyncContacts
Redmond1
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
?__abi_WinRTraiseWrongThreadException@@YAXXZ
AccountsControlUI.Models.AccountsDataModel.ShowPicture
AccountsControlUI.ViewModels.DeleteAccountViewModel.DeleteCommand
A^_^[]
__crtCompareStringW
SyncSettingsTextButtonAutomationName
api-ms-win-core-synch-l1-1-0.dll
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
t$XH!\$0L
D$ fD
L9{@u
OpenSemaphoreW
fF9<@u
Remove
file too large
AccountsControlUI.ViewModels.AccountSettingsViewModel.ClientAuthCertificateValidity
r~akow
VWATAUAWH
not a socket
AccountsControlUI.ViewModels.AllDoneViewModel.DoneCommand
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel
FallbackError
Reconnect
f9H\u
EnterCriticalSection
.CRT$XCU
___lc_collate_cp_func
\$ E3
"2 X6
_errno
AccountsControlUI.ViewModels.AccountsViewModel.ShowUserInformation
ImportedAccounts
IsErrorCodeAvailable
ShowNeedMoreCharactersInfo
T$XH;
AccountsControlUI.ViewModels.AccountsViewModel.SkipBubbleHeadView
ProgressText
ClientAuthCertificateIssuer
GtH;O
graph
AccountsControlUI.ViewModels.AccountSettingsViewModel.ShowChooseClientAuthCertificate
oK0D$"<
%hs(%d) tid(%x) %08X %ws
Windows.Foundation.IReferenceArray`1<Windows.UI.Xaml.Markup.XmlnsDefinition>
D9d$H}lH
AccountsControlUI.ViewModels.SyncSettingsViewModel.SaveCommand
AccountsControlUI.ViewModels.AccountsViewModel.SavedAccounts
GetCurrentProcess
,6gHhRn4U2Yrkbt1+dbown4wqg+aS/cGeDJ1sFF64+b4=0Z
AccountsControlUI.ViewModels.AccountsViewModel.QueryResultAccounts
SyncFrequencySelectedValue
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.SyncFrequencyTitle
iOP4$?
ShowPasswordInputField
fileName
ClientAuthCertificateValidity
:\u5L
not a stream
AccountsToBeAdded
Manage
L9o@t
.?AVResultException@wil@@
AccountsControlUI.ViewModels.SyncSettingsViewModel.DownloadAllEmailContentsText
9t$p~;H
AccountsControlUI.ViewModels.AccountsViewModel.AccountShareApprovalText
Windows.UI.Xaml.ApplicationInitializationCallback
Account
Translation
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
Windows.Foundation.Collections.IVectorView`1<Windows.UI.Xaml.Markup.IXamlMetadataProvider>
A_A^A]A\_^]
IsPageDescriptionVisible
AccountsControlUI.ViewModels.AllDoneViewModel.IconBitmap
ShowSettingsButton
alnum
CommandInProgress
operation_not_supported
t$8H!\$PL
d:\os\public\amd64fre\internal\sdk\inc\wil\result.h
.?AV?$Array@PE$AAVString@Platform@@$00@Platform@@
IsExpanded
ClientAuthCertificateIssuedTo
9k(tyH
address_not_available
??0NotImplementedException@Platform@@QE$AAA@XZ
ProductVersion
AccountsControlUI.ViewModels.UsernameDomainSignInViewModel.CancelCommand
.PE$AAVOutOfMemoryException@Platform@@
tHfD91u;H
.?AU?$IBoxArray@PE$AAVString@Platform@@@Platform@@
UsernameEditable
__CxxFrameHandler3
connection_refused
_onexit
AccountsControlUI.ViewModels.AccountsViewModel.ShowDefaultUserIcon
.CRT$XIAA
ShowSelectedClientAuthCertificate
H;}PH
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.ServerRequiresSsl
no_protocol_option
A_A^A\_^[]
failureType
AccountsControlUI.ViewModels.ExchangeAuthTypeDiscoveryViewModel.EmailAddress
AccountsControlUI.ViewModels.AccountsViewModel.DifferentAccountTitle
` AVH
H;L$Pu
Windows
function not supported
hresult
AccountsControlUI.ViewModels.AccountsViewModel.UserName
D$0E3
8A_A^_^][
unH9A
invalid argument
no such device
.idata$2
??0Delegate@Platform@@QE$AAA@XZ
api-ms-win-core-debug-l1-1-0.dll
x AVH
Windows.Foundation.Collections.IVector<String>
.CRT$XCL
CurrentlySyncingLabel
OutgoingServerUseSameUsernamePassword
.?AVObject@Platform@@
1/0-0
BubbleHeadAccount
illegal byte sequence
Windows.Foundation.Collections.IObservableVector<AccountsControlUI.ViewModels.ImportedAccountDisplayProperties>
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.SyncFrequencyTitle
AWilError_02
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerRequiresAuth
SkipBubbleHeadView
AccountsControlUI.Models.AccountsDataModel.NeedAttention
AccountsControlUI.ViewModels.FixPasswordViewModel
Searching
AccountsControlUI.ViewModels.ActiveSyncAdvancedSignInViewModel.AccountPassword
AccountsControlUI.ViewModels.FixPasswordViewModel.IconBitmap
.xdata
.gfids
SaveCommand
AccountsControlUI.ViewModels.ImportedAccountDisplayProperties.IconBitmap
h23mr9
AccountsControlUI.ViewModels.AccountsViewModel.RelatedTelemetryId
AccountsControlUI.ViewModels.InternetEmailAdvancedSignInViewModel.SignInCommand
190726204550Z0p1
??0exception@@QEAA@AEBV0@@Z
%hs(%d)\%hs!%p:
Operating System
OutgoingServerUsesPassword
ShowImportedAccounts
AccountsControlUI.ViewModels.AccountSettingsViewModel.UsernameEditable
AccountsControlUI.ViewModels.AllDoneViewModel.Icon
N0L0J
vector<T> too long
AccountsControlUI.ViewModels.ActiveSyncSyncSettingsViewModel.Server
GetModuleHandleExW
AccountsControlUI.ViewModels.AccountsViewModel.SelectedItemChooseAccount
H;K`H
_cexit
AccountsControlUI.ViewModels.AADViewModel.AADNeedCredentialsPageDescriptionText
;cY7.u'
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.OutgoingServerUsername
@VWAWH
H;}`H
SignInCommand
Q}oy7?
t$ WATAUAVAWH
GetLastError
_commode
@USVWATAUAVAWH
UWAWH
AccountsControlUI.ViewModels.ViewModelBase.NextCommandEnabled
LogHr
S-1-15-2-2790696044-4250746149-3450687576-2678734014-1999437079-3283195315-1729643650
_amsg_exit
??0bad_cast@@QEAA@AEBV0@@Z
AccountsControlUI.ViewModels.ImportAccountsViewModel.ShowImportedAccounts
AccountsControlUI.ViewModels.AccountsViewModel.ShowNeedMoreCharactersInfo
?terminate@@YAXXZ
AUAVAWH
AccountsControlUI.ViewModels.InternetMailSyncSettingsViewModel.IsDavAccount
AccountsControlUI.ViewModels.DeleteAccountViewModel.Icon
BubbleHeadAccounts
Unknown
AccountsControlUI.ViewModels.YourEmailDisplayNameViewModel.YourName
AADNeedCredentialsTitleText
WindowsCompareStringOrdinal
L$HL;
no_buffer_space
AccountsControlUI.ViewModels.FixPasswordViewModel.PromptForPasswordText
ShowUserInformation
d:\os\src\shellcommon\shell\accountscontrol\app\host\app.xaml.cpp
invalid stoi argument
api-ms-win-core-winrt-error-l1-1-1.dll
A_A^A]A\]
A_A^A]_]
InitOnceBeginInitialize
UserName
SelectedAccountType
ProgressTextHelper
`.rdata
SyncEmail
L;0u*H
AccountsControlUI.ViewModels.YourEmailDisplayNameViewModel.AccountTypeTitle
OnLaunchedEvent
regex_error(error_brack): The expression contained mismatched [ and ].
9S|ucH
H;D$(u
AccountsControlUI.ViewModels.GoogleOAuthViewModel.IsCreateAccountFlow
lineNumber
ShowRequireSslFields
AccountsControlUI.ViewModels.MainPageViewModel
20180915002813Z
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | PDB Path | Compile Time | Import Hash | Exported DLL Name |
|---|---|---|---|---|---|---|---|---|
| 0x140000000 | 0x0006a1f0 | 0x000c6bda | 0x000c6bda | 6.0 | AccountsControlHost.pdb | 2018-09-15 00:57:50 | e2a05fe8273e1b6d2dd7ff6bbc8dfd4f | AccountsControlHost.exe |
Version Infos
| CompanyName | Microsoft Corporation |
|---|---|
| FileDescription | Accounts Control Host |
| FileVersion | 10.0.17763.1 (WinBuild.160101.0800) |
| InternalName | AccountsControlHost |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | AccountsControlHost.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.17763.1 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x0006e82c | 0x0006ea00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.16 |
| .rdata | 0x0006ee00 | 0x00070000 | 0x000432ee | 0x00043400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.51 |
| .data | 0x000b2200 | 0x000b4000 | 0x00004158 | 0x00003600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.88 |
| .pdata | 0x000b5800 | 0x000b9000 | 0x00004cd4 | 0x00004e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.83 |
| .rsrc | 0x000ba600 | 0x000be000 | 0x00000420 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 2.49 |
| .reloc | 0x000bac00 | 0x000bf000 | 0x00000d0c | 0x00000e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 5.33 |
Overlay
| Offset | 0x000bba00 |
| Size | 0x00002210 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x000be060 | 0x000003c0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.44 | None |
Imports
| Name | Address |
|---|---|
| ?what@exception@@UEBAPEBDXZ | 0x140070300 |
| ?terminate@@YAXXZ | 0x140070308 |
| ??0exception@@QEAA@AEBQEBD@Z | 0x140070310 |
| wcsstr | 0x140070318 |
| memset | 0x140070320 |
| wcslen | 0x140070328 |
| _CxxThrowException | 0x140070330 |
| ??0exception@@QEAA@AEBQEBDH@Z | 0x140070338 |
| memcpy | 0x140070340 |
| memmove | 0x140070348 |
| _callnewh | 0x140070350 |
| setlocale | 0x140070358 |
| ___mb_cur_max_func | 0x140070360 |
| ___lc_handle_func | 0x140070368 |
| ___lc_codepage_func | 0x140070370 |
| __pctype_func | 0x140070378 |
| calloc | 0x140070380 |
| ___lc_collate_cp_func | 0x140070388 |
| __CxxFrameHandler3 | 0x140070390 |
| memcmp | 0x140070398 |
| abort | 0x1400703a0 |
| _wcsdup | 0x1400703a8 |
| __crtCompareStringW | 0x1400703b0 |
| __crtLCMapStringW | 0x1400703b8 |
| ??0exception@@QEAA@XZ | 0x1400703c0 |
| ??1exception@@UEAA@XZ | 0x1400703c8 |
| ??0exception@@QEAA@AEBV0@@Z | 0x1400703d0 |
| _get_current_locale | 0x1400703d8 |
| _free_locale | 0x1400703e0 |
| memmove_s | 0x1400703e8 |
| _vsnwprintf | 0x1400703f0 |
| memcpy_s | 0x1400703f8 |
| _commode | 0x140070400 |
| _fmode | 0x140070408 |
| _vsnprintf_s | 0x140070410 |
| _purecall | 0x140070418 |
| ??3@YAXPEAX@Z | 0x140070420 |
| _acmdln | 0x140070428 |
| __setusermatherr | 0x140070430 |
| _ismbblead | 0x140070438 |
| _cexit | 0x140070440 |
| _exit | 0x140070448 |
| exit | 0x140070450 |
| __set_app_type | 0x140070458 |
| __getmainargs | 0x140070460 |
| _initterm | 0x140070468 |
| malloc | 0x140070470 |
| _amsg_exit | 0x140070478 |
| _XcptFilter | 0x140070480 |
| ??1type_info@@UEAA@XZ | 0x140070488 |
| _onexit | 0x140070490 |
| __C_specific_handler | 0x140070498 |
| __dllonexit | 0x1400704a0 |
| _unlock | 0x1400704a8 |
| _lock | 0x1400704b0 |
| realloc | 0x1400704b8 |
| strchr | 0x1400704c0 |
| free | 0x1400704c8 |
| ??0bad_cast@@QEAA@PEBD@Z | 0x1400704d0 |
| ??1bad_cast@@UEAA@XZ | 0x1400704d8 |
| ??0bad_cast@@QEAA@AEBV0@@Z | 0x1400704e0 |
| wcsrchr | 0x1400704e8 |
| wcstol | 0x1400704f0 |
| _errno | 0x1400704f8 |
| Name | Address |
|---|---|
| EventRegister | 0x1400702d0 |
| EventActivityIdControl | 0x1400702d8 |
| EventWriteTransfer | 0x1400702e0 |
| EventUnregister | 0x1400702e8 |
| EventSetInformation | 0x1400702f0 |
| Name | Address |
|---|---|
| GetModuleHandleExW | 0x140070098 |
| GetModuleFileNameA | 0x1400700a0 |
| GetProcAddress | 0x1400700a8 |
| GetModuleHandleW | 0x1400700b0 |
| Name | Address |
|---|---|
| GetProcessHeap | 0x140070078 |
| HeapAlloc | 0x140070080 |
| HeapFree | 0x140070088 |
| Name | Address |
|---|---|
| ReleaseSemaphore | 0x140070158 |
| OpenSemaphoreW | 0x140070160 |
| CreateSemaphoreExW | 0x140070168 |
| WaitForSingleObjectEx | 0x140070170 |
| CreateMutexExW | 0x140070178 |
| ReleaseSRWLockExclusive | 0x140070180 |
| AcquireSRWLockExclusive | 0x140070188 |
| InitializeCriticalSectionEx | 0x140070190 |
| DeleteCriticalSection | 0x140070198 |
| AcquireSRWLockShared | 0x1400701a0 |
| EnterCriticalSection | 0x1400701a8 |
| ReleaseMutex | 0x1400701b0 |
| ReleaseSRWLockShared | 0x1400701b8 |
| WaitForSingleObject | 0x1400701c0 |
| LeaveCriticalSection | 0x1400701c8 |
| Name | Address |
|---|---|
| CreateThreadpoolTimer | 0x140070210 |
| CloseThreadpoolTimer | 0x140070218 |
| SetThreadpoolTimer | 0x140070220 |
| WaitForThreadpoolTimerCallbacks | 0x140070228 |
| Name | Address |
|---|---|
| DebugBreak | 0x140070020 |
| OutputDebugStringW | 0x140070028 |
| IsDebuggerPresent | 0x140070030 |
| Name | Address |
|---|---|
| TerminateProcess | 0x1400700d8 |
| GetCurrentProcess | 0x1400700e0 |
| GetCurrentProcessId | 0x1400700e8 |
| GetCurrentThreadId | 0x1400700f0 |
| GetStartupInfoW | 0x1400700f8 |
| Name | Address |
|---|---|
| FormatMessageW | 0x1400700c0 |
| GetLocaleInfoEx | 0x1400700c8 |
| Name | Address |
|---|---|
| SetUnhandledExceptionFilter | 0x140070040 |
| UnhandledExceptionFilter | 0x140070048 |
| SetLastError | 0x140070050 |
| GetLastError | 0x140070058 |
| Name | Address |
|---|---|
| CloseHandle | 0x140070068 |
| Name | Address |
|---|---|
| InitOnceComplete | 0x1400701d8 |
| InitOnceBeginInitialize | 0x1400701e0 |
| Sleep | 0x1400701e8 |
| Name | Address |
|---|---|
| CoTaskMemFree | 0x140070000 |
| CoTaskMemAlloc | 0x140070008 |
| CoCreateFreeThreadedMarshaler | 0x140070010 |
| Name | Address |
|---|---|
| RtlCaptureContext | 0x140070118 |
| RtlVirtualUnwind | 0x140070120 |
| RtlLookupFunctionEntry | 0x140070128 |
| Name | Address |
|---|---|
| QueryPerformanceCounter | 0x140070108 |
| Name | Address |
|---|---|
| GetTickCount | 0x1400701f8 |
| GetSystemTimeAsFileTime | 0x140070200 |
| Name | Address |
|---|---|
| EncodePointer | 0x140070238 |
| DecodePointer | 0x140070240 |
| Name | Address |
|---|---|
| SetRestrictedErrorInfo | 0x140070250 |
| RoOriginateError | 0x140070258 |
| RoFailFastWithErrorContext | 0x140070260 |
| Name | Address |
|---|---|
| RoReportUnhandledError | 0x140070270 |
| Name | Address |
|---|---|
| WindowsCreateStringReference | 0x140070280 |
| WindowsCreateString | 0x140070288 |
| WindowsDeleteString | 0x140070290 |
| WindowsConcatString | 0x140070298 |
| WindowsDuplicateString | 0x1400702a0 |
| WindowsIsStringEmpty | 0x1400702a8 |
| WindowsGetStringRawBuffer | 0x1400702b0 |
| WindowsCompareStringOrdinal | 0x1400702b8 |
| WindowsGetStringLen | 0x1400702c0 |
| Name | Address |
|---|---|
| MultiByteToWideChar | 0x140070138 |
| WideCharToMultiByte | 0x140070140 |
| GetStringTypeW | 0x140070148 |
Exports
| Name | Address | Ordinal |
|---|---|---|
| DllCanUnloadNow | 0x14006c150 | 1 |
| DllGetActivationFactory | 0x14006c170 | 2 |
| VSDesignerDllMain | 0x140024410 | 3 |
Usage
Processing ( 0.82 seconds )
- 0.813 CAPE
- 0.006 BehaviorAnalysis
- 0.004 AnalysisInfo
- 0.001 Debug
Signatures ( 0.06 seconds )
- 0.008 ransomware_files
- 0.006 antiav_detectreg
- 0.005 antianalysis_detectfile
- 0.005 ransomware_extensions
- 0.003 infostealer_ftp
- 0.003 territorial_disputes_sigs
- 0.003 ursnif_behavior
- 0.002 antiav_detectfile
- 0.002 infostealer_bitcoin
- 0.002 infostealer_im
- 0.002 poullight_files
- 0.001 antianalysis_detectreg
- 0.001 antivm_vbox_files
- 0.001 antivm_vbox_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 uac_bypass_cmstpcom
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 infostealer_mail
- 0.001 masquerade_process_name
- 0.001 revil_mutexes
- 0.001 modirat_behavior
Reporting ( 0.00 seconds )
- 0.002 CAPASummary
- 0.001 JsonDump
Signatures
The PE file contains a PDB path
pdbpath: AccountsControlHost.pdb
SetUnhandledExceptionFilter detected (possible anti-debug)
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
\Device\CNG
\Device\CNG
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Xaml.Application\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
Local\SM0:880:304:WilStaging_02
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.