This article introduces how to collect the UMH logs for a application crash issue caused by the UMH module.
UMH is an engine in OSCE that supports the enhanced ransomware solution. It is installed in the Common Client Solution Framework (CCSF) service as a module. It provides API events for other modules, such as Behavior Monitoring, Predictive Machine Learning, etc. Those modules will make decisions according to the provided API events from UMH.
Below is the installation path for UMH in OSCE:
<OfficeScan Agent Installation Path>\CCSF\MODULE\20019\
UMH has been involved since OfficeScan 11.0 Service Pack 1 Critical Patch 6054 (Ransomware CP) and OfficeScan XG.
To collect the UMH logs:
- Set the registry key. Create a reg file and copy following content into it:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps]
"DumpFolder"=hex(2):43,00,3a,00,5c,00,6c,00,6f,00,63,00,61,00,6c,00,64,00,75,\
00,6d,00,70,00,73,00,00,00
"DumpType"=dword:00000002 - Import the reg file. Windows will collect the dump in the C:\localdumps folder automatically.
- Trigger the problem.
- Collect the dump file from the C:\localdumps folder.
- Get the UMH-related binary files:
- <OSCE installation path>\CCSF\module\20019
- %windir%\system32\tmumh
- %windir%\syswow64\tmumh
- %windir%\system32\drivers\tmumh.sys
- Get the UMH-related registry keys:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
- Remove the imported registry keys after the logs are collected.
