dmenrollengine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dmenrollengine.dll
Resource
win10v2004-20240508-en
General
-
Target
dmenrollengine.dll
-
Size
741KB
-
MD5
1fc22b00cb0a2ac3a27a15ab2383ac70
-
SHA1
c9c82380a30308e10daa430f42af22ee8e80ad63
-
SHA256
3e8574d0ae7d5cd46ebdbe812bfb60c4f30a691ffcbb3793c470a534874bc689
-
SHA512
36fcd9f42ea262b50d86530202944ab161228010e9cea032a353d61056ddf8386186d380b78cf68c7b8ce9a2d4451cddc8b8832c89e996f463f8e9e26f358cbd
-
SSDEEP
12288:ly5LJl/3l/Jl/Vl/I+G3OGdVtU2WTWd1Zrz8hWv0ohhigJkrrdB:lGLJl/3l/Jl/Vl/IgUVtUrToKhNoDigQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dmenrollengine.dll
Files
-
dmenrollengine.dll.dll windows:10 windows x86 arch:x86
356e53ace49814a395d2818dabb37143
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp110_win
?good@ios_base@std@@QBE_NXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
?_Xbad_alloc@std@@YAXXZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
??0id@locale@std@@QAE@I@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
msvcrt
memcpy
memcmp
__RTDynamicCast
_CxxThrowException
memmove
toupper
??3@YAXPAX@Z
__CxxFrameHandler3
_vsnwprintf
memcpy_s
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
wcstod
wcsstr
wcstoul
swscanf_s
wcsrchr
isspace
_wtol
wcsncmp
_itow_s
strncpy_s
_set_errno
strtol
swprintf
strchr
strrchr
memset
_wcslwr
towlower
_wtof
realloc
sprintf_s
wcsnlen
_errno
_vsnwprintf_s
_wtoi
wcschr
wcscpy_s
wcstok_s
free
_wcsdup
ldiv
_wcsicmp
??_V@YAXPAX@Z
_wcsnicmp
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
ntdll
RtlIsStateSeparationEnabled
RtlNtStatusToDosError
RtlPublishWnfStateData
RtlGetVersion
RtlGetDeviceFamilyInfoEnum
crypt32
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertOpenStore
CryptExportPublicKeyInfoEx
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertFreeCertificateChain
CryptFindOIDInfo
CertComparePublicKeyInfo
CertSetCertificateContextProperty
PFXImportCertStore
CertEnumCertificatesInStore
PFXExportCertStoreEx
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertGetNameStringW
CryptEncodeObjectEx
CryptEncodeObject
CryptMsgClose
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToEncode
CryptMsgCalculateEncodedLength
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertCloseStore
oleaut32
SysAllocStringLen
VariantChangeType
SysAllocStringByteLen
VariantClear
VariantInit
SysStringByteLen
SysStringLen
SysFreeString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayGetUBound
SysAllocString
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseMutex
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockShared
WaitForSingleObjectEx
WaitForSingleObject
CreateEventExW
InitializeCriticalSection
ReleaseSRWLockExclusive
ResetEvent
InitializeSRWLock
OpenSemaphoreW
LeaveCriticalSection
OpenEventW
EnterCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionEx
SetEvent
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateProcessW
GetCurrentProcess
GetCurrentThreadId
GetExitCodeProcess
CreateProcessAsUserW
TerminateThread
CreateThread
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
GetHandleInformation
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventRegister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalAlloc
LocalFree
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsCreateString
WindowsDuplicateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetVersionExW
GetSystemTime
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoRevertToSelf
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoWaitForMultipleHandles
CLSIDFromString
CoInitializeEx
CoUninitialize
StringFromCLSID
StringFromGUID2
IIDFromString
CoCreateFreeThreadedMarshaler
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegEnumKeyExW
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteTreeW
RegDeleteValueW
RegEnumValueW
RegDeleteKeyExW
RegQueryValueExW
RegOpenCurrentUser
rpcrt4
RpcBindingFree
NdrClientCall4
UuidFromStringW
UuidCreate
I_RpcExceptionFilter
RpcBindingBind
RpcBindingCreateW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
WakeAllConditionVariable
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
bcrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-file-l1-1-0
CompareFileTime
GetFileSize
FindNextFileW
ReadFile
DeleteFileW
WriteFile
FindClose
RemoveDirectoryW
GetFullPathNameW
FindFirstFileW
CreateFileW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchCombine
PathCchAppend
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
ChangeServiceConfigW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrlenA
api-ms-win-core-url-l1-1-0
UrlEscapeW
devobj
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
RegDeleteKeyW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
userenv
LeaveCriticalPolicySection
EnterCriticalPolicySection
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
AutoEnrollMDM
BeginEnrollmentScope
CleanupExpiredOMADMSessions
DiscoverEndpoint
DiscoverEndpointEx
DiscoverEndpointEx2
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EnableLogging
EnrollEngineInitialize
FindDiscoveryService
FindDiscoveryServiceEx
FreeMmpcDiscoveryResultsData
GetCertificatePolicy
GetDatabaseManagerInstance
GetEnrollmentAadResourceUrl
GetEnrollmentAadSendDeviceToken
GetEnrollmentAuthPolicy
GetEnrollmentCertStore
GetEnrollmentClientCertThumbprint
GetEnrollmentClientContext
GetEnrollmentCurCryptoProvider
GetEnrollmentDiscoveryService
GetEnrollmentEntDmId
GetEnrollmentForceAadToken
GetEnrollmentLinkedEnrollmentHasPriority
GetEnrollmentLinkedEnrollmentId
GetEnrollmentLinkedEnrollmentLockedToMMPC
GetEnrollmentPartnerOpaqueID
GetEnrollmentSID
GetEnrollmentState
GetEnrollmentType
GetEnrollmentUPN
GetEnrollmentsOfTypes
GetFirstEnrollmentGuidOfTypes
GetIsRecoveryAllowed
GetMmpcEnrollmentFlag
GetProviderID
GetRecoveryInitiatedByServer
GetRecoveryRetryCount
GetRecoveryStatusEnum
IsLockedToMmpc
MmpcDiscoverEndpoint
OpenEnrollmentsHKEY
SetEnrollState
SetEnrollmentAadResourceUrl
SetEnrollmentAadSendDeviceToken
SetEnrollmentDormant
SetEnrollmentForceAadToken
SetEnrollmentPartnerOpaqueID
SetEnrollmentUPN
SetIsRecoveryAllowed
SetMmpcEnrollmentFlag
SetProviderID
SetRecoveryInitiatedByServer
SetRecoveryRetryCount
SetRecoveryStateAndErrorCode
SwitchAADLinkedEnrollment
SysprepGeneralize
VerifyServerIsMmpcEx
_IsManagementRegistrationAllowed
Sections
.text Size: 669KB - Virtual size: 669KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ