8f62eb2cfebc88799e9ce3ba1a6a74f15ec5e24d6ec81ec2fe6db86d8f137dbd

Analysis

user interaction
yes
max time kernel
449s
max time network
428s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
umi_0.1.0_x64_en-US.msi
Size 4.1MB
Sample260822-pt9ltafa73
SHA256 8f62eb2cfebc88799e9ce3ba1a6a74f15ec5e24d6ec81ec2fe6db86d8f137dbd
MD5 ac8a77b343ce348bab171bf45f0e5237
SHA1 4f420bba81c89d63541dd548cbd4b4ce2806ae2d
SHA512 2037282fc79b4a1cad4520b582e5a32d0cfb5c6ba22f9020a93db345c90f512e7f7347e10dcaaa9c4379f790433f678b948543782512fa7dbe2af3a5d060c5f8
SSDEEP 98304:E9CdFarzYKn3tYdLZXa5OztSxsfnC1DOTm:iCWdORa568OkDO
TLSH
T12816331B7FD1A633CC562EBA143BE3A41A3C3C245F5861431290BA5ECCF22E15E75AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1036	umi.exe

Loads dropped DLL 1 IoCs

pid	Process
4680	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	umi.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\umi\umi.exe	msiexec.exe
File created	C:\Program Files\umi\Uninstall umi.lnk	msiexec.exe
File opened for modification	C:\Program Files\umi\config.json	umi.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e597f48.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{B5D8F3A6-CC4A-4706-9771-9ADFBB281A77}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{B5D8F3A6-CC4A-4706-9771-9ADFBB281A77}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e597f4a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_493341633\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF50482015441838FD.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5D8F3A6-CC4A-4706-9771-9ADFBB281A77}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD783BE0B50502D4A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6434BBABFA766675.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF108E2D998B1FE069.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e597f48.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84F5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_493341633\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_493341633\manifest.json	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4256	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6A3F8D5BA4CC60747917A9FDBB82A177	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6A3F8D5BA4CC60747917A9FDBB82A177\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6A3F8D5BA4CC60747917A9FDBB82A177\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\PackageCode = "EA8DBD77BDC4CAC47866B7B0EF3FA5CB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\Version = "65536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCA59BD797B0D825A81279877E17A594\6A3F8D5BA4CC60747917A9FDBB82A177	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\PackageName = "umi_0.1.0_x64_en-US.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6A3F8D5BA4CC60747917A9FDBB82A177\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCA59BD797B0D825A81279877E17A594	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\ProductIcon = "C:\\Windows\\Installer\\{B5D8F3A6-CC4A-4706-9771-9ADFBB281A77}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6A3F8D5BA4CC60747917A9FDBB82A177\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\ProductName = "umi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6A3F8D5BA4CC60747917A9FDBB82A177\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2708	msiexec.exe
2708	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4780	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4256	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4256	msiexec.exe
Token: SeSecurityPrivilege	2708	msiexec.exe
Token: SeCreateTokenPrivilege	4256	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4256	msiexec.exe
Token: SeLockMemoryPrivilege	4256	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4256	msiexec.exe
Token: SeMachineAccountPrivilege	4256	msiexec.exe
Token: SeTcbPrivilege	4256	msiexec.exe
Token: SeSecurityPrivilege	4256	msiexec.exe
Token: SeTakeOwnershipPrivilege	4256	msiexec.exe
Token: SeLoadDriverPrivilege	4256	msiexec.exe
Token: SeSystemProfilePrivilege	4256	msiexec.exe
Token: SeSystemtimePrivilege	4256	msiexec.exe
Token: SeProfSingleProcessPrivilege	4256	msiexec.exe
Token: SeIncBasePriorityPrivilege	4256	msiexec.exe
Token: SeCreatePagefilePrivilege	4256	msiexec.exe
Token: SeCreatePermanentPrivilege	4256	msiexec.exe
Token: SeBackupPrivilege	4256	msiexec.exe
Token: SeRestorePrivilege	4256	msiexec.exe
Token: SeShutdownPrivilege	4256	msiexec.exe
Token: SeDebugPrivilege	4256	msiexec.exe
Token: SeAuditPrivilege	4256	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4256	msiexec.exe
Token: SeChangeNotifyPrivilege	4256	msiexec.exe
Token: SeRemoteShutdownPrivilege	4256	msiexec.exe
Token: SeUndockPrivilege	4256	msiexec.exe
Token: SeSyncAgentPrivilege	4256	msiexec.exe
Token: SeEnableDelegationPrivilege	4256	msiexec.exe
Token: SeManageVolumePrivilege	4256	msiexec.exe
Token: SeImpersonatePrivilege	4256	msiexec.exe
Token: SeCreateGlobalPrivilege	4256	msiexec.exe
Token: SeCreateTokenPrivilege	4256	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4256	msiexec.exe
Token: SeLockMemoryPrivilege	4256	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4256	msiexec.exe
Token: SeMachineAccountPrivilege	4256	msiexec.exe
Token: SeTcbPrivilege	4256	msiexec.exe
Token: SeSecurityPrivilege	4256	msiexec.exe
Token: SeTakeOwnershipPrivilege	4256	msiexec.exe
Token: SeLoadDriverPrivilege	4256	msiexec.exe
Token: SeSystemProfilePrivilege	4256	msiexec.exe
Token: SeSystemtimePrivilege	4256	msiexec.exe
Token: SeProfSingleProcessPrivilege	4256	msiexec.exe
Token: SeIncBasePriorityPrivilege	4256	msiexec.exe
Token: SeCreatePagefilePrivilege	4256	msiexec.exe
Token: SeCreatePermanentPrivilege	4256	msiexec.exe
Token: SeBackupPrivilege	4256	msiexec.exe
Token: SeRestorePrivilege	4256	msiexec.exe
Token: SeShutdownPrivilege	4256	msiexec.exe
Token: SeDebugPrivilege	4256	msiexec.exe
Token: SeAuditPrivilege	4256	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4256	msiexec.exe
Token: SeChangeNotifyPrivilege	4256	msiexec.exe
Token: SeRemoteShutdownPrivilege	4256	msiexec.exe
Token: SeUndockPrivilege	4256	msiexec.exe
Token: SeSyncAgentPrivilege	4256	msiexec.exe
Token: SeEnableDelegationPrivilege	4256	msiexec.exe
Token: SeManageVolumePrivilege	4256	msiexec.exe
Token: SeImpersonatePrivilege	4256	msiexec.exe
Token: SeCreateGlobalPrivilege	4256	msiexec.exe
Token: SeCreateTokenPrivilege	4256	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4256	msiexec.exe
Token: SeLockMemoryPrivilege	4256	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4256	msiexec.exe
1036	umi.exe
4256	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4256	msiexec.exe
2708	msiexec.exe
4680	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4680	2708	msiexec.exe	90
PID 2708 wrote to memory of 2348	2708	msiexec.exe	97
PID 4256 wrote to memory of 1036	4256	msiexec.exe	101
PID 1036 wrote to memory of 4780	1036	umi.exe	102
PID 4780 wrote to memory of 2848	4780	msedgewebview2.exe	103
PID 4780 wrote to memory of 4228	4780	msedgewebview2.exe	104
PID 4780 wrote to memory of 4228	4780	msedgewebview2.exe	104
PID 4780 wrote to memory of 4228	4780	msedgewebview2.exe	104
PID 4780 wrote to memory of 4228	4780	msedgewebview2.exe	104
PID 4780 wrote to memory of 3864	4780	msedgewebview2.exe	105
PID 4780 wrote to memory of 2328	4780	msedgewebview2.exe	106
PID 4780 wrote to memory of 2328	4780	msedgewebview2.exe	106
PID 4780 wrote to memory of 2328	4780	msedgewebview2.exe	106
PID 4780 wrote to memory of 3192	4780	msedgewebview2.exe	107
PID 4780 wrote to memory of 3192	4780	msedgewebview2.exe	107
PID 4780 wrote to memory of 3192	4780	msedgewebview2.exe	107
PID 4780 wrote to memory of 3192	4780	msedgewebview2.exe	107
PID 4780 wrote to memory of 3192	4780	msedgewebview2.exe	107
PID 4780 wrote to memory of 3320	4780	msedgewebview2.exe	108
PID 4780 wrote to memory of 3320	4780	msedgewebview2.exe	108
PID 4780 wrote to memory of 3320	4780	msedgewebview2.exe	108
PID 4780 wrote to memory of 4100	4780	msedgewebview2.exe	111
PID 4780 wrote to memory of 4100	4780	msedgewebview2.exe	111
PID 4780 wrote to memory of 4100	4780	msedgewebview2.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\umi_0.1.0_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files\umi\umi.exe
  "C:\Program Files\umi\umi.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1036.4620.15050282591842966170 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.umi.app\EBWebView /prefetch:4 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffdafe95fd8,0x7ffdafe95fe4,0x7ffdafe95ff0
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2480 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3312 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.umi.app\EBWebView" --webview-exe-name=umi.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4752 --field-trial-handle=1756,i,3798312013162095599,3662758271721395843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22cf3813cc3fb47e8e5237db4ddf04b342ba616f
      4⤵
      PID:4100

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1454C12253E0C57BA8BF109DFE3D096D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4680
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597f49.rbs

Path C:\Config.Msi\e597f49.rbs
Size 9KB
SHA256 3e9cb192570c8f6a0e99d6f47ad6a5701e6aa2bef029419f85f16edbc885176a
MD5 4ccd996a19790b7e1600dc24efd833d8
SHA1 e5283b53f5a246fac807df2b6380bc51164b531c
SHA512 8464b5dc877238992aa168a8ff1ab4f4bf6b022b5c29c28b74db5da43184e34f0496a6db5e3ffb4eb0ccd5b49154e36617d39fdd056f4c9094e71ad5c792a8bb
SSDEEP 96:4img5P8lf9CEA+7CHgztUWgNWCOTlQUWgNWCgjr+q2BTlW2d45blF15575Q+55Q3:66Mf9CE5CiGWgFGlWgFTInD3/WNiabpN
TLSH
T171223006732586E2F99B1B31CB0B1B647FE3D3D89714234B198D95A04F177852FAE28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umi.exe

Path C:\Program Files\umi\umi.exe
Size 8.4MB
SHA256 fbc00d6f610dcd69fd75a70ce9d09020a0f0cbd65288983ea753f809ea791f84
MD5 c3b84bb3823c9584d0374701d8145b4a
SHA1 ce30b5d3e32b470024e9276f88724b11a4f06200
SHA512 ba1fd684522b2d2f6f0ace90e52a97d70e93c80ef61e0dfabd965f6bf3bd5e14299447298e2626072986a0b6b26573ff7edcdbb5fe1d40b00b18b6a7c5aa746c
SSDEEP 98304:0+VysLjqyKSARbU9pbZKvUlJf21tLAfS9GvaGBUuzbErFloX0nPEj16xYYYd/Xnr:0kaR43oJ1tWS9VrdsoA/XP8
TLSH
T152965A53F76280E8C17AC074935A6233FA617C494B357AEB5BE04B213E65F906B3DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umi.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\umi\umi.lnk
Size 1KB
SHA256 cfe7a55cdcf3521906eeb9bc26cd387da37c4d8f881765ea7db23523802585c2
MD5 22e44f2cd0dee2f491230b777556d1ec
SHA1 ea569ba1b77d0a28c881f3f698fee9c9881a22c6
SHA512 136eb8edf7df66c9be91e94f6bab5f5d96dcb538b8279cfd22eca5e1e2b4806391ba58596e5c27c5f6dfd770a9a29fabbeea94d4ef0b7157e729d945196225c1
TLSH
T182410F1096E80767E3B247345F719B328B37F81BFD208F2A4189018709B80009598F2F
MD5 SHA1 SHA512 TLSH

Submit Download

umi.lnk~RFe59865d.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\umi\umi.lnk~RFe59865d.TMP
Size 1KB
SHA256 b5debd59e7807b85b24b1502068699412570c9c0b064f62e48ef426644c5cf5f
MD5 1237774e15922c3b82b22fdf63bca89b
SHA1 4c4aaec7caf9f149194177e44b291b1bd8e9ab48
SHA512 753dee21af42b97370be5cb82e950f3436d371b39c2de942c22ce94fd80f1d88717aff601e0abb0e169201e8ea843bfc60e68a33b518c9243cc4d166d56fdeb8
TLSH
T1D631112047E80B2BE3B287345F715B328B37FC0AEE708F2B4189018709B4000D598F1E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2B8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2B8B.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0b7457291818a3f211155d4e9fe7a02f6d65de6c4dcea1f553f4bb1a586cd1e1
MD5 ba73be6b105e383f30ab6d206a76092e
SHA1 efcf3572d14c19a320b2e2ed4760a27c39a8f599
SHA512 27346e41805fbb98d679e2fd530d7fd5a89bfd66b07e865526b6a48d71bae4f393b845805a3bd9beaadf6f5fcb1def2816cb86a7e5201a30ce31fa8115de2b2d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 121d75ddec63c19545d39c8b4f72a9b2670d7451e5e814d402e4c50f0d473413
MD5 064a3b445107cf20c6da75d55f9dd73e
SHA1 9957ed86f1b9b0214f9662cf0922a339f1cd4ff7
SHA512 1db0ece7e7c7e491d05f4d5a06e79717125e96cf36b3cfbec3032d97425057e0054e68a71ddfe11e07cc6943f77c2777679c252b7a51d3e0ac5073875a3acd01
TLSH
T152D012223B010134C1142133005261081C00C10BC04540895838891F5E884610907442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 975bdec3cb4dd3bfc864f0564e2527106c5298c2e01b6b541f214ff534dc6f83
MD5 55643113dcfb70568e01038313eb0ece
SHA1 d19c5e1e633202343c295f8c08b90ebdff8facea
SHA512 f2ddffde77a9539e09b5f38013158327c67c89a7196edc5c1f9e175e5d704d38784c2554e0d10e7c3c01384f4b6057f9af9ab00eea7de2af5b3f9c7ae4f093bb
TLSH
T185C09210401F085AE363CEF8B4CA008633785C5882833D8E88E30434A0713114213040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2348.TMP

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2348.TMP
Size 48B
SHA256 57cccd99fdb5bfb7d19a7d8e6eaa879f79fc2063b9c89a047bdb12b64cfa1119
MD5 3f5ef6f4b04a9bd3aeb8f0ac9af5b218
SHA1 bfb5b89fa1529ed1a96478a7ccc1ad1a3193b42b
SHA512 1ee9adf79f8a8c876f9215c1f83a643dd7ed95232eb7f2c48b40b53db672b84acbfffcaf7a3c553218dee764ddeb544df81f4d4d086d177c4878d6dfd49ecf67
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 7915084c02fde9e8f1d8d7a00e5ff9444dc29776852ef60b5d52f125b9ed2f50
MD5 f889cd92021dd54d3867b157783af74a
SHA1 4ae15c1a489d2ce5b6d593a374c35fce7c045cc7
SHA512 8a359eca014b333bb1c0d9011630123875aedf7e82e977dd00d64f9ea48cadac81742b84c927d77cd65ea06352bd72bfb4b4132e981107dbbf316ba8cbf76932
SSDEEP 3:MsEllllkEthXllkl2zE/ln/f:/M/xT02zS
TLSH
T1424402446BD00416C50021714091835017B1EC1006225B83649508325C856401C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 d2a261d00d6fbd5313588f0121f5e35379a0566b5692677709d82affb6c58952
MD5 71240489b9b233733c497434dd37620d
SHA1 152fea9a3687f2822ceea9204747a1917b3893f8
SHA512 a32216bdec864cbd84a3a51861272a5ac05931df537a64300d81ae6ae21a55193a48df079e6d55f5aa378870cb0ec018bcc3f363a2889e4330f05dd2add801d9
TLSH
T1F221A2A6C3E4C66D894127E427347813CD2E0519A2283D27CDDAFBDA97D10B1D21154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ae541.TMP

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Network\Network Persistent State~RFe5ae541.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Preferences
Size 6KB
SHA256 5436aaf68d05933446c16df609dd607b35b2312dede56f9b5c9035ede7e322c9
MD5 6bbe9ec3df770560cdd757ed3780caf1
SHA1 9fefb7bf74bb5f770cff7e355a59367b53a35f19
SHA512 5dbb9b9ff78f4c0ff0f646cb0c5f6bebbf17ecb13c481791f9d7d008e06ebbd9455f7f4aa4e9ce298fc399329ba69cb23b450dc03c7c37a4127cd6af30443980
SSDEEP 192:stAziVl0FUx7onAHsV+Fdo54jkcXM7G6K:stAziVlSUxfHsGq4gYM/K
TLSH
T123D185015E2879BB8CCBF219BA397A17E2F9607275D51E58EBF8452C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Preferences
Size 6KB
SHA256 fb28736724ba42481ea5bbdfbe133521de3c2d86ae1c818f5a266e98b58a26de
MD5 b0860ba86ca301ad7922b15d9d1ae69b
SHA1 a68a13ca772ee124bd954c62f4aad2396822c26d
SHA512 4e2737a75d9fb819a45086463f11e1729cf4072a96a897c733a50ba0534b588aca69fa33e8490fe8ab74ce61ee856c0088256e5332e4a346c49ffa76ff8ffcce
SSDEEP 192:stAziVl0FUeX7onAHsV+Fdjh2jkcjIHDvg6K:stAziVlSUeXfHsG72gIIHD1K
TLSH
T1EFD184015E24A97B8CCBF519BA35BB17E3F9607271D12E48EBF8462C04DB6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2bc4.TMP

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\Preferences~RFe5a2bc4.TMP
Size 5KB
SHA256 b89e728102c6f5fef6fadca0abe443313bc964f746263d1da9b7b487dd4dea9c
MD5 89b8c418633259b8a4224d9eed8da4cb
SHA1 d7b7c3dca8905c8f6832df142c6a9a765ac921d4
SHA512 034eff95a8d156d9c54fb9312f2f15a390d52c3e7f1664d2d9c1dc3409946f46e7430cdd144167601bd89b6e807bfd106ce133d29a145c484b2ff12467296c7f
SSDEEP 96:rAr/dgVl0cQwr+b9Ukqfdo616Z0AHs7/x+6MhmuecJAI0Y1ejetxK+gaPM728XMz:rAziVl0FUxlo6AHsV+FdAI0YQjkc4PMy
TLSH
T19AC194025E28797B8CCAF119BA397A16E2FD507275D52E58EBF8462C04DB6CC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 15KB
SHA256 9ec8eb1f30ae9826a5292f7810ef88567ac35f474c2a400d277892bb09d509f5
MD5 0f1c18734c51939061cdefa6eed94144
SHA1 e4a36fd364d745f8209476a773d109d69b4c3162
SHA512 3eab861b945bd87faad7566dba559e4b04a6f6d9ec965d2e63f73a4420aa7cc46018ed718004749b647d02b705fd07d5ffb3e281f35a794b7f6fcf998b08d095
SSDEEP 384:Z0+aQikB+z/xvxjg/qhE6bNBSe6CHW3Cu/zy8dIq03nAVdpv9zwb:p/UxvxjgC+jW3UvFU
TLSH
T18572AF1754387E63A5F6EA15794D1B8BCBFC84B291C16E688EBD5F0906C72D81342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 3KB
SHA256 249e35871d40ce461fafcd5a59d800560c57bec032ed4f65b77047b5a0152fd2
MD5 88c7ffc298b4ea0ec28b436fd2178e13
SHA1 42d0f0a1edc9cdda5f46c18daaef8d460c6bc853
SHA512 dab82704422a63805539466f541c24aef4ad06b0ee77e2d02e7fd22df3dfb331b13cd18f7ebaec1c490fb5622ac37abf94abd5057c6d6d0f36616bc592fbb090
TLSH
T1768196226974A9378EF6DA0578863B07ABA99033E5D17F95CAEC0F0C41D73DD1382827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 17KB
SHA256 ab031375ce0274422b229a127519527a0381579eba75372321b77ba800d88099
MD5 cb93dba14c7e9d7945fe411d868a8d5c
SHA1 170204bc1c1f8e47cff8f6815f0ddeec4ac0f787
SHA512 c4e541372c5e6b781dc668a36c537c663c61bfd8d1c7a31d1d4d00b7d7684dcba47dc7562135518638e92c3518990525e4428e4eb05b20429d394cd8ce0e6eb0
SSDEEP 384:Zs+aQikB+z/xvxjg/qhEY3NBSe6COwCuiy8dIq4z/775AVdpv9zwb:x/UxvxjgC+Ymq775UvFU
TLSH
T1E7829D36D834AA23A8F7E745764A6B8BCBF8857251C15EE48DEC6F0D06C32DD0342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 1KB
SHA256 3e094a6d96b89505168240ad72dd60dc5f28fd1d8560549bc6c9af31ab4e4a45
MD5 8a5d3bdafc5fe4d732c4748ce292af82
SHA1 ad235ca9ddbab198a19dc763ab30dba0af07ed69
SHA512 fef049fecc9099c7d55f8011ea85c49373f2ac020ce2abf8ad673637e64b684a683fd1df7335f12f5bd2564d90917ee41ee49bb7baa044a772828e5ff3378824
TLSH
T145219571D8746733ACD5661131463A4B9E2A517A82908F00D6DD0B2845E21DDA96AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 2KB
SHA256 64c7d96773b68e247cc21c8d466281b057ab51d853ba51cd66ac912853d94df6
MD5 34c5573ac8a3d23cf21109d678a9f19e
SHA1 9f4e3a1a5b2a7552c0150f3f5dd696ec3399b47f
SHA512 14d9ba0fd1f463100f283b3bc5ed4b427ba557ec37efabff5bf4955f3f4cb894c8f7525e8cbcbd9829b108293a4ff484ede82c7076fad7b027cac694b7a8879e
TLSH
T1655195326C24A737CAE25714784A3A13DE7E91719A911F10CADC0B1841D26DD2786C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.umi.app\EBWebView\Local State
Size 3KB
SHA256 db30c56c911e0c4deeccdc811564208f2517c82d404e0a77ae182b9bc1b31150
MD5 711dd388d3e308081d9369d2d81a058c
SHA1 3d588aad9a12b879a5ff162c671e8da40ca7e807
SHA512 cf553bd2cf94a887f98a9a4a530b91133c3882192c07f11fedddaca99b76f2b9900606495d3094adff6cfff425a228f0bcbc49405fb0c63101d50278631f7be0
TLSH
T1986185266974A9378EF29A15B8863B06ABA95133E5D17F55CAEC0F1C41D33DC1382C27
MD5 SHA1 SHA512 TLSH

Submit Download

e597f48.msi

Path C:\Windows\Installer\e597f48.msi
Size 4.1MB
SHA256 8f62eb2cfebc88799e9ce3ba1a6a74f15ec5e24d6ec81ec2fe6db86d8f137dbd
MD5 ac8a77b343ce348bab171bf45f0e5237
SHA1 4f420bba81c89d63541dd548cbd4b4ce2806ae2d
SHA512 2037282fc79b4a1cad4520b582e5a32d0cfb5c6ba22f9020a93db345c90f512e7f7347e10dcaaa9c4379f790433f678b948543782512fa7dbe2af3a5d060c5f8
SSDEEP 98304:E9CdFarzYKn3tYdLZXa5OztSxsfnC1DOTm:iCWdORa568OkDO
TLSH
T12816331B7FD1A633CC562EBA143BE3A41A3C3C245F5861431290BA5ECCF22E15E75AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 c4a19efcce94bab487d0c8e597ea9d47a4789e52780bef471a48b9b1034a6cc6
MD5 0e0eac1e305de5fd72cbb7411bd0c0af
SHA1 cb3c135a3f2a9545b2597d8960b231220d863e79
SHA512 3f8cf0c5fb90d3f6275a60260bbbadb7633ed361b927b767d5c0398e80f3cac5f73a4c4a4b791b3819b8edfa88aea6b9833a9b47dc168872b60e5a91ccaac3c7
SSDEEP 24576:fFo3DMPjdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+X:xHM
TLSH
T14157B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7cd3eb27-fc50-4724-9b7f-b5671b3a0fbb}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7cd3eb27-fc50-4724-9b7f-b5671b3a0fbb}_OnDiskSnapshotProp
Size 6KB
SHA256 fa28a9556d8f25b180626ccae637e21eb87f107fb3909b3e5e13da2adec7d888
MD5 8f06f3c7cfd0213c3509208109c57e60
SHA1 3f38cda6b8605687ca5c46f1aca720a54e9a49bb
SHA512 933516133e5c85d7257059c1371b054b68cd5dc61934450ef24c499c25bd3b0e377319f21a43ddb3e6cc948945ce1c0a6d31097809638568050a61ca61f074ef
SSDEEP 96:FnFI0bwvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:lFI/b++uVm
TLSH
T14DD187085AF54711E2B3AB3228F18557A877B911EF33CB8E0198638E6671910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3192-95-0x00007FFDD0830000-0x00007FFDD0831000-memory.dmp

Download

memory/4100-302-0x00007FFDD2320000-0x00007FFDD2321000-memory.dmp

Download

memory/4100-301-0x00007FFDD1980000-0x00007FFDD1981000-memory.dmp

Download

memory/4228-74-0x00007FFDD0830000-0x00007FFDD0831000-memory.dmp

Download