528fa41b114782af6d2cbda2947c73ecae5cdd971c9d12f0faceb2a2ee70ac6c

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	TunnelBear-Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{44103b82-9412-4f6e-9f7d-e011ac692e8b} = "\"C:\\ProgramData\\Package Cache\\{44103b82-9412-4f6e-9f7d-e011ac692e8b}\\TunnelBear-Installer.exe\" /burn.runonce"	TunnelBear-Installer.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	rundll32.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	TunnelBear-Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\tap-tb-0901.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tap-tb-0901.inf_amd64_a087624970f7fef3\tap-tb-0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	TunnelBear.Maintenance.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\Url.1zhmqa4cjvwiuqhpb5bwh3xzcbthtmcj\Files\__PolarBearSettings	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\tap-tb-0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tap-tb-0901.inf_amd64_a087624970f7fef3\tap-tb-0901.PNF	tapinstall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\Url.1zhmqa4cjvwiuqhpb5bwh3xzcbthtmcj\identity.dat	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\info.dat	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172E.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\Url.eik1pxc0s0s11uon3zzphsd4ngd1ag0b\identity.dat	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\tap-tb-0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tap-tb-0901.inf_amd64_a087624970f7fef3\tap-tb-0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30D802E0E248FEE17AAF4A62594CC75A	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\identity.dat	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172F.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	TunnelBear.Maintenance.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tap-tb-0901.inf_amd64_a087624970f7fef3\tap-tb-0901.inf	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30D802E0E248FEE17AAF4A62594CC75A	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f1384d2-73c6-f34c-8a4c-7560e647966a}\SET172D.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	TunnelBear.Maintenance.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\IsolatedStorage\1mfvuydq.mda\0vyhufky.o3l\Zone.MyComputer\Url.1zhmqa4cjvwiuqhpb5bwh3xzcbthtmcj\Files\__PolarBearSettings	TunnelBear.Maintenance.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\6\14.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bearpin_23.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bear_tunnel_animation_09_hover.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\8\6.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\14\15.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\10\1.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\SQLitePCLRaw.nativelibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bearpin_02.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\6\7.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\15\12.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bearpin_22.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_129.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_139.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_76.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\5\0.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\PolarSDK.Firewall.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_77.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\10\6.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Ratings\good_desktop_00028.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\8\7.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\lib\vlc\plugins\video_chroma\libswscale_plugin.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\PolarSDK.Wireguard.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Ratings\bad_desktop_00043.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\15\3.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\6\5.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bearpin_01.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Drivers\x64\WdfCoinstaller01009.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Bins\x64\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_105.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\2\9.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\9\12.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_136.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\15\15.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\10\10.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\9\7.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_02.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_127.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Drivers\x64\tap-tb-0901.inf	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\PolarSDK.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Ratings\good_desktop_00021.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_124.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\13\12.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_143.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\4\1.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\1\11.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_85.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\8\2.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_19.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Bins\x86\wireguard.exe	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Ratings\good_desktop_00008.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Secured_connection\secured_connection_bear_28.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Moq.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\ko\Microsoft.Expression.Interactions.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_47.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\fr\TunnelBear.ViewModels.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\2\15.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\bearpin_outofdata_05.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\8\7.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Images\Login_follow_bear\login_follow_bear_78.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4\9\5.png	msiexec.exe
File created	C:\Program Files (x86)\TunnelBear\Assets\Maps\4_1\12\4.png	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53D1.tmp-\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\msvcp140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp-\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI53D1.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1	msiexec.exe
File created	C:\Windows\Installer\e5709a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI108A.tmp-\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI108A.tmp-\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI44A.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\{A6BA1A8D-0B38-4AD7-9CD4-A6C5EFB7B71C}\TunnelBear.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI44A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\Installer\MSI44A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI108A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\vccorlib140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\vccorlib140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\vcruntime140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI169.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp-\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2BE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53D1.tmp-\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI108A.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI53D1.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp-\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp-\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI169.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp-\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2720.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DA6.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\concrt140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\msvcp140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI108A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI53D1.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e5709a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp-\TunnelBear.Setup.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E1.tmp-\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{A6BA1A8D-0B38-4AD7-9CD4-A6C5EFB7B71C}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI988C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D8A1AB6A83B07DA4C94D6A5CFE7B7BC1\4.7.1\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{A6BA1A8D-0B38-4AD7-9CD4-A6C5EFB7B71C}\TunnelBear.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI169.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI44A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\e5709a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 11 IoCs

pid	Process
3488	TunnelBear-Installer.exe
2236	TunnelBear-Installer.exe
532	vcredist140_x86.exe
2120	vcredist140_x86.exe
512	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
800	TunnelBear.exe
1880	TunnelBear.UI.exe
3256	tapinstall.exe
1944	TunnelBear.exe
4072	TunnelBear.UI.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
396	sc.exe
4424	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3488	TunnelBear-Installer.exe
3488	TunnelBear-Installer.exe
3488	TunnelBear-Installer.exe
3488	TunnelBear-Installer.exe
3488	TunnelBear-Installer.exe
2120	vcredist140_x86.exe
3120	MsiExec.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
3120	MsiExec.exe
3120	MsiExec.exe
3340	rundll32.exe
3340	rundll32.exe
3340	rundll32.exe
3340	rundll32.exe
3340	rundll32.exe
3120	MsiExec.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
2980	MsiExec.exe
2980	MsiExec.exe
3728	rundll32.exe
3728	rundll32.exe
3728	rundll32.exe
3728	rundll32.exe
3728	rundll32.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
512	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2980	MsiExec.exe
1844	rundll32.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\WOW6432Node\CLSID\{8816027c-d5cf-4c23-89ab-b01f6d5bed4e}\LocalServer32\ = "\"C:\\Program Files (x86)\\TunnelBear\\TunnelBear.UI.exe\" -ToastActivated"	TunnelBear.UI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\WOW6432Node\CLSID\{8816027c-d5cf-4c23-89ab-b01f6d5bed4e}\LocalServer32	TunnelBear.UI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\WOW6432Node\CLSID\{8816027c-d5cf-4c23-89ab-b01f6d5bed4e}\LocalServer32\ = "\"C:\\Program Files (x86)\\TunnelBear\\TunnelBear.UI.exe\" -ToastActivated"	TunnelBear.UI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027c70fafd0cbe6b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027c70faf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090027c70faf000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\TunnelBear.UI.exe = "1"	TunnelBear.UI.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	TunnelBear.UI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TunnelBear.UI.exe = "0"	TunnelBear.UI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TunnelBear.UI.exe = "0"	TunnelBear.UI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TunnelBear.UI.exe = "1"	TunnelBear.UI.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	TunnelBear.UI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\TunnelBear.UI.exe = "1"	TunnelBear.UI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TunnelBear.UI.exe = "1"	TunnelBear.UI.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	tapinstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	TunnelBear.Maintenance.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	tapinstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	TunnelBear.Maintenance.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	TunnelBear.Maintenance.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	TunnelBear.Maintenance.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\SimAuth.dll,-1001 = "EAP-SIM"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	tapinstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	TunnelBear.Maintenance.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	TunnelBear.Maintenance.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	tapinstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	tapinstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tapinstall.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46CFE871-9E2E-37C9-BDDA-1E1809567D12}\InprocServer32\Class = "PolarSDK.OpenVPN.Services.Implementations.Logger.ExampleLoggerService"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A06BF257-07E2-3941-8DFC-5EC29D2EC6D3}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C2351956-A740-366B-AE7F-C658099722F7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.AppCenter.CancellationException\ = "Microsoft.AppCenter.CancellationException"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolarSDK.Common.Models.DataUsageResponse\CLSID\ = "{228B77B2-442F-3302-A293-78B51FA2FA08}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0FFD1A-A930-380B-86E4-89572624CACB}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Win32.TaskScheduler.TaskService\ = "Microsoft.Win32.TaskScheduler.TaskService"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E4788F25-8418-3693-85ED-B8683B5CD0EC}\ = "Microsoft.Win32.TaskScheduler.ShowMessageAction"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DDAE3C7B-7FC8-3ED4-91B6-20723F70351F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6D47D1C-F528-3A6C-A9F2-5A9A1655F3DC}\InprocServer32\1.7.0.0\Class = "DnsClient.DnsQueryAndServerOptions"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAEA3FE3-6941-312F-B2ED-E1E5B0E3E312}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B9CFC665-6151-31C9-9B0E-0F99D24CCD5B}\4.2.0.1\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AA34901D-D6CC-303F-BE2C-674D1915D138}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2351956-A740-366B-AE7F-C658099722F7}\InprocServer32\Class = "TunnelBear.Services.Models.VpnServiceSettings"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A468604-34E8-3617-959C-40DA097CC8C6}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89B29FAB-20E7-384A-87B8-2006AA7FB7B5}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9A829252-FEA5-360E-AE08-10DD9A1AABA1}\0.0.0.0\Class = "Microsoft.AppCenter.Ingestion.Models.ValidationException+Rule"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolarSDK.API.Models.RequestCompleteEventArgs\ = "PolarSDK.API.Models.RequestCompleteEventArgs"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86B31909-680F-3BC7-9598-76948210C82E}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9FEB24EB-921E-3FB2-8CEB-A7F085A704DC}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FEB24EB-921E-3FB2-8CEB-A7F085A704DC}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.QueryStringDotNET.QueryString\ = "Microsoft.QueryStringDotNET.QueryString"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77A10244-F96D-3CFA-BE68-DC7E48C975DC}\InprocServer32\0.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE1C727C-FBB6-3578-9E94-C283C3AAB2B8}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{728C8EEB-8D6F-3CA4-BCE8-622B10CD779C}\InprocServer32\1.32.13.0\Class = "PolarSDK.Common.Models.Results.DeviceDataUsageResult"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2C302860-6675-334B-B762-9FB1343093D6}\5.6.1.0\Assembly = "Polly, Version=5.6.1.0, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0F457819-694D-3054-99E3-7E3024982827}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\CommandId = "IE.Protocol"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECD60AD-0AAB-3B77-8974-C9D5E3CF9CD7}\InprocServer32\Assembly = "Microsoft.Toolkit.Uwp.Notifications, Version=5.0.0.0, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6E7A0555-CA7B-39EA-827F-2A2EF85D8520}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA994712-5CDC-33BF-A4F2-223721D00096}\ProgID\ = "TunnelBear.Services.ApiResponses.CountriesResponse"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56A0829D-3C12-3747-8534-AB6C5B6376DB}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7B0D1DBF-7D48-3D66-A09F-38BEAE0ECBD7}\InprocServer32\1.1.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7CCF74CD-5C82-31F2-9110-D322C06C0690}\5.0.0.0\Assembly = "Microsoft.Toolkit.Uwp.Notifications, Version=5.0.0.0, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DA1AD478-3AE0-3251-88AC-F2D44BB57475}\2.7.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E4451A56-C28B-31C1-8450-916AB218C7A2}\ProgID\ = "PolarSDK.Common.Models.Results.StartVpnResult"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D6FF724E-5FA9-3F26-881B-C3A2AB1165FF}\1.7.0.0\Assembly = "DnsClient, Version=1.7.0.0, Culture=neutral, PublicKeyToken=4574bb5573c51424"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C6E650BE-8FE6-30D9-8948-ABF09078660C}\InprocServer32\1.6.4.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46AEE9E5-7BA2-31C5-8882-067313F9736D}\InprocServer32\1.32.13.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{22FC8AC2-0AE0-3C18-BC10-440ED2986B49}\5.6.1.0\CodeBase = "file:///C:\\Program Files (x86)\\TunnelBear\\Polly.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{0B917538-9AC4-3D4D-B1F5-34E69F195D55}\4.0.1.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TunnelBear.Models.CountryMap	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F654610-BCE1-3D86-8003-23047F637D46}\InprocServer32\1.0.0.0\CodeBase = "file:///C:\\Program Files (x86)\\TunnelBear\\TunnelBear.Models.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{54ABD027-36BF-3DF9-96F6-463F453A9123}\1.0.0.0\Class = "TunnelBear.Services.Core.ThemeSelector"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{E57A9486-8AA9-3737-AA8E-261D48585EF5}\1.7.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{79A44CDC-3AAF-38DF-9DD8-DD2F078F8DA4}\2.7.0.0\Assembly = "Microsoft.Win32.TaskScheduler, Version=2.7.0.0, Culture=neutral, PublicKeyToken=c416bc1b32d97233"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{79A44CDC-3AAF-38DF-9DD8-DD2F078F8DA4}\2.7.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DA1AD478-3AE0-3251-88AC-F2D44BB57475}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{7E006FF7-F98D-35A9-B24F-370988FD4150}\1.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.AppCenter.Utils.ApplicationLifecycleHelper	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{7CCF74CD-5C82-31F2-9110-D322C06C0690}\5.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BDE30F46-4A2B-3290-947E-638B584B6099}\4.0.1.1\Assembly = "System.Memory, Version=4.0.1.1, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C198D057-00AF-346D-A01E-8AB8A144425E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9BD0EBBF-E95B-3823-BF7F-6898D37D80A5}\1.0.0.0\Class = "TunnelBear.Models.PlanType"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8816027C-D5CF-4C23-89AB-B01F6D5BED4E}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E3B6940B-71E3-3156-8095-D806C80C7A4A}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FAEA01BB-FABF-3D59-BC35-1D5E667B922C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F670EF0-95CC-383A-B518-5DF8F55AF8CA}\ = "Microsoft.AppCenter.Utils.Files.File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{974B120F-A3F8-3869-AA26-D6ED15B35D71}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{63ACD17A-750A-3E6A-B647-220298F8A824}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B912B4BB-4A0E-3FAD-8837-856010D9315A}\InprocServer32\1.1.0.0\Assembly = "SQLite-net, Version=1.1.0.0, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9729E04C-D135-39F0-B009-22C48910CC89}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B1F2D9DE-AC22-34EA-B2EF-BC602A4B276B}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\IconHandler	ie4uinit.exe

Modifies system certificate store 2 TTPs 21 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000019000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877604000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B762BA83B609A957A69BB4EBCEF3923FBA4EA854	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TunnelBear.Maintenance.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6AF0CF1D7FBD54EC6E797659CC023D8BF92E5667	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6AF0CF1D7FBD54EC6E797659CC023D8BF92E5667\Blob = 0300000001000000140000006af0cf1d7fbd54ec6e797659cc023d8bf92e5667040000000100000010000000f233fe2fa290ab96c24ea5bde578e1820f0000000100000020000000b4939065341c4383b71881417d82d7e6f0c4e0be22c3c4e94f4b8f21cda62ec51400000001000000140000000e26bf98b014a2774bdb0baaf5407b09246bcbef1900000001000000100000000d2b7abaf1bcd154e7cb16d4007116e25c000000010000000400000000080000180000000100000010000000fc741b3b78cfb31e075744fe5d0eeb964b000000010000000200000000002000000001000000420600003082063e30820526a00302010202110091994337d5265c83ec4a985341602bac300d06092a864886f70d01010b050030818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e2053656375726520536572766572204341301e170d3232303631363030303030305a170d3233303731363233353935395a301d311b301906035504030c122a2e6c617a657270656e6775696e2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c164c34b00fe0cd0f3fc8a311a008f90844a367c01d8df4bd7c82a541583aa313b77e638457130c39bdfbfad399a36896adb2691e7b1d656a76033035560f9e529af9fe0d3acbb9d9b98af52025098c1c6cd3a16b9dc1f92fb47037661f191d7d863e6dc1a2ba22dba7cc9b1ee8762472c5e94dc3c54858fb51fe305f6c310b5c67dfc14c70b8a94297abcf6d002cceb4ab39811392c5af6a1e8ab433b42ce82644f3039dadda26b541ba66df4440be90f19e7e9679fbca75538ebf42b17f30d01f2955709ab7456da93e7b6becf705f9e43f599e0023004af1a519daceb91e1d7be3482faded75cd2f3a4993650cdb7b031fcef4e8fb533c20249362694f51b0203010001a382030430820300301f0603551d230418301680148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1301d0603551d0e041604140e26bf98b014a2774bdb0baaf5407b09246bcbef300e0603551d0f0101ff0404030205a0300c0603551d130101ff04023000301d0603551d250416301406082b0601050507030106082b0601050507030230490603551d20044230403034060b2b06010401b231010202073025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533008060667810c01020130818406082b0601050507010104783076304f06082b060105050730028643687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f525341446f6d61696e56616c69646174696f6e53656375726553657276657243412e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d302f0603551d110428302682122a2e6c617a657270656e6775696e2e636f6d82106c617a657270656e6775696e2e636f6d3082017c060a2b06010401d6790204020482016c048201680166007600adf7befa7cff10c88b9d3d9c1e3e186ab467295dcfb10c24ca858634ebdc828a000001816cf9fa4e0000040300473045022100cd0417b913499b6e8c25fbb296c25e02650a6d8c18ab6a8767765878e1b8499002204be55585cdcffe529dac3d646496b057d09166e8f72207b30c6b98ffa5bea0730075007a328c54d8b72db620ea38e0521ee98416703213854d3bd22bc13a57a352eb52000001816cf9fa3d000004030046304402205ae94c2f66402210e9aad1bdbbe9d105335e063a59d3a52a6f82653d92de82da02207ad11fe30bc2f4c48b6a2609125970732124f245b0bc285b4a2d4ba24c4769bc007500e83ed0da3ef5063532e75728bc896bc903d3cbd1116beceb69e1777d6d06bd6e000001816cf9f9eb000004030046304402202fed17608eabc63477a77d8dab754bd40489f06b8910969a6db7b6fd96d8a77c022021f33a1cb222cc5c442a243f36f4de3c18b5589b0586033b48edcf295856028c300d06092a864886f70d01010b05000382010100bc89fac982fc48f2af7acdc0b92e9edd881efef6068dfc750b04121d93518cd1e8262a3e8d240450719504c1c269ac738753f2606954ab54d7f3d57cb65400a7c586b3a42be399b3433cda7a7896d44aaad0199e14503689363e6b1885dc33e6cc36f343d8bd0bc5ea65a2a3d7f96d01775f8c4577142d475480bcd8d7bd36cb1d97f4ec48af13c6b8e8588bd04a5b2b626f5f3cba1d70d5cb9f0c1f1064560813980ccf1a9be3eba89177c802f7b33d231b9c911b5b604debfd5dd16ea284b74af2deae14be4b0316b22831eda5c86bc63b88bc9db7835820f98cb79901ccaa15e36924c83f99b151fff596e0e652c13da205013a79c18759dc22332485debd	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B762BA83B609A957A69BB4EBCEF3923FBA4EA854\Blob = 030000000100000014000000b762ba83b609a957a69bb4ebcef3923fba4ea85420000000010000003b050000308205373082041fa003020102020707e3509c94be98300d06092a864886f70d01010505003081ca310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e31333031060355040b132a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72793130302e06035504031327476f204461646479205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083037393639323837301e170d3133303830393138323130315a170d3135303830323138313131395a3062310b3009060355040613024341310b3009060355040813024f4e3110300e06035504071307546f726f6e746f31193017060355040a131054756e6e656c426561722c20496e632e311930170603550403131054756e6e656c426561722c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd5de9f4a1e40511c913b824f1a10507458e0f4f74ee5809a118a4ace21808b985dfe59f4250bb50a89cebe6910a8a67669b6af01150ea645606ea2680076282a15fa53599cc39e04b63157e974d6c8f1a24a4c54435aa7e10cfc7498d653b15ea5160b77a6245126a471eea3de3d0314efec8d109c6977caba4aee5bf9ee315f7c7965f067d0a226185b32646d145b4c128640482e65c9fa44de02bd3b8fb653d574ac7519592160b6126247d44538006603f911e2b7bdf2e7b33061cd1dd23e075423f725337bb2d8ec435c8530cafa923d94b653bf542abe73559cdb044eaedceaf675ef5c9172f03e6eb50e4fbe5a2f4f5685bd4e400e1cf78522610161f0203010001a382018730820183300f0603551d130101ff0405300301010030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676f64616464792e636f6d2f676473352d31362e63726c30530603551d20044c304a3048060b6086480186fd6d010717023039303706082b06010505070201162b687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f30818006082b0601050507010104743072302406082b060105050730018618687474703a2f2f6f6373702e676f64616464792e636f6d2f304a06082b06010505073002863e687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f67645f696e7465726d6564696174652e637274301f0603551d23041830168014fdac6132936c45d6e2ee855f9abae7769968cce7301d0603551d0e0416041428a65616d44066aef516988d078486b9748dcf11300d06092a864886f70d010105050003820101001cc976a1422c9e382713404b051a0dee7748e8055358a9ac461988d53d3e050d9b1295fa97e3e5d5c1192dc7c25d6d784995e16950301009dbb15c36c1273c5c9d3b29867cf26a8e8a32b159caf92759bdada9670c19f7deafc3d5228d1ea333afba1a45c14db618e822a8439140fb474eadebbadac9682053553cbd9170bb13827014ff694a49e358d33261e8119e3749f87d100e9b6cae67ef31e92969d75afdaa458313e1feddaf67608bdc381e21802fe1f61280167d0fd969bba2bd2043df3769be5284b2ece661b482bd15135acc394f47e6f15a4c07ae6a880b6bab4b0abcfbc1de18b33b0a13c5a21e54aaebdd981360eb8a504395cd684187e44f70	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B762BA83B609A957A69BB4EBCEF3923FBA4EA854\Blob = 0f00000001000000140000001cb1b6f49eeeb25a2caf2536f147c660dd84c1d7030000000100000014000000b762ba83b609a957a69bb4ebcef3923fba4ea85420000000010000003b050000308205373082041fa003020102020707e3509c94be98300d06092a864886f70d01010505003081ca310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e31333031060355040b132a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72793130302e06035504031327476f204461646479205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083037393639323837301e170d3133303830393138323130315a170d3135303830323138313131395a3062310b3009060355040613024341310b3009060355040813024f4e3110300e06035504071307546f726f6e746f31193017060355040a131054756e6e656c426561722c20496e632e311930170603550403131054756e6e656c426561722c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd5de9f4a1e40511c913b824f1a10507458e0f4f74ee5809a118a4ace21808b985dfe59f4250bb50a89cebe6910a8a67669b6af01150ea645606ea2680076282a15fa53599cc39e04b63157e974d6c8f1a24a4c54435aa7e10cfc7498d653b15ea5160b77a6245126a471eea3de3d0314efec8d109c6977caba4aee5bf9ee315f7c7965f067d0a226185b32646d145b4c128640482e65c9fa44de02bd3b8fb653d574ac7519592160b6126247d44538006603f911e2b7bdf2e7b33061cd1dd23e075423f725337bb2d8ec435c8530cafa923d94b653bf542abe73559cdb044eaedceaf675ef5c9172f03e6eb50e4fbe5a2f4f5685bd4e400e1cf78522610161f0203010001a382018730820183300f0603551d130101ff0405300301010030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676f64616464792e636f6d2f676473352d31362e63726c30530603551d20044c304a3048060b6086480186fd6d010717023039303706082b06010505070201162b687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f30818006082b0601050507010104743072302406082b060105050730018618687474703a2f2f6f6373702e676f64616464792e636f6d2f304a06082b06010505073002863e687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f67645f696e7465726d6564696174652e637274301f0603551d23041830168014fdac6132936c45d6e2ee855f9abae7769968cce7301d0603551d0e0416041428a65616d44066aef516988d078486b9748dcf11300d06092a864886f70d010105050003820101001cc976a1422c9e382713404b051a0dee7748e8055358a9ac461988d53d3e050d9b1295fa97e3e5d5c1192dc7c25d6d784995e16950301009dbb15c36c1273c5c9d3b29867cf26a8e8a32b159caf92759bdada9670c19f7deafc3d5228d1ea333afba1a45c14db618e822a8439140fb474eadebbadac9682053553cbd9170bb13827014ff694a49e358d33261e8119e3749f87d100e9b6cae67ef31e92969d75afdaa458313e1feddaf67608bdc381e21802fe1f61280167d0fd969bba2bd2043df3769be5284b2ece661b482bd15135acc394f47e6f15a4c07ae6a880b6bab4b0abcfbc1de18b33b0a13c5a21e54aaebdd981360eb8a504395cd684187e44f70	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TunnelBear.Maintenance.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B762BA83B609A957A69BB4EBCEF3923FBA4EA854	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TunnelBear.Maintenance.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf4b0000000100000044000000300037004300450046003200460036003500340045003300450044003600300035003000460046004300390042003600450042003800340034003200350030005f00000020000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f	TunnelBear.Maintenance.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	TunnelBear.Maintenance.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	TunnelBear.Maintenance.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1212	rundll32.exe
1212	rundll32.exe
3892	msiexec.exe
3892	msiexec.exe
3488	TunnelBear-Installer.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
3064	chrome.exe
3064	chrome.exe
3816	chrome.exe
3816	chrome.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
2508	TunnelBear.Maintenance.exe
4988	Taskmgr.exe
4988	Taskmgr.exe
4988	Taskmgr.exe
4988	Taskmgr.exe
4116	Taskmgr.exe
4116	Taskmgr.exe
4116	Taskmgr.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3404	vssvc.exe
Token: SeRestorePrivilege	3404	vssvc.exe
Token: SeAuditPrivilege	3404	vssvc.exe
Token: SeShutdownPrivilege	2236	TunnelBear-Installer.exe
Token: SeIncreaseQuotaPrivilege	2236	TunnelBear-Installer.exe
Token: SeSecurityPrivilege	3892	msiexec.exe
Token: SeCreateTokenPrivilege	2236	TunnelBear-Installer.exe
Token: SeAssignPrimaryTokenPrivilege	2236	TunnelBear-Installer.exe
Token: SeLockMemoryPrivilege	2236	TunnelBear-Installer.exe
Token: SeIncreaseQuotaPrivilege	2236	TunnelBear-Installer.exe
Token: SeMachineAccountPrivilege	2236	TunnelBear-Installer.exe
Token: SeTcbPrivilege	2236	TunnelBear-Installer.exe
Token: SeSecurityPrivilege	2236	TunnelBear-Installer.exe
Token: SeTakeOwnershipPrivilege	2236	TunnelBear-Installer.exe
Token: SeLoadDriverPrivilege	2236	TunnelBear-Installer.exe
Token: SeSystemProfilePrivilege	2236	TunnelBear-Installer.exe
Token: SeSystemtimePrivilege	2236	TunnelBear-Installer.exe
Token: SeProfSingleProcessPrivilege	2236	TunnelBear-Installer.exe
Token: SeIncBasePriorityPrivilege	2236	TunnelBear-Installer.exe
Token: SeCreatePagefilePrivilege	2236	TunnelBear-Installer.exe
Token: SeCreatePermanentPrivilege	2236	TunnelBear-Installer.exe
Token: SeBackupPrivilege	2236	TunnelBear-Installer.exe
Token: SeRestorePrivilege	2236	TunnelBear-Installer.exe
Token: SeShutdownPrivilege	2236	TunnelBear-Installer.exe
Token: SeDebugPrivilege	2236	TunnelBear-Installer.exe
Token: SeAuditPrivilege	2236	TunnelBear-Installer.exe
Token: SeSystemEnvironmentPrivilege	2236	TunnelBear-Installer.exe
Token: SeChangeNotifyPrivilege	2236	TunnelBear-Installer.exe
Token: SeRemoteShutdownPrivilege	2236	TunnelBear-Installer.exe
Token: SeUndockPrivilege	2236	TunnelBear-Installer.exe
Token: SeSyncAgentPrivilege	2236	TunnelBear-Installer.exe
Token: SeEnableDelegationPrivilege	2236	TunnelBear-Installer.exe
Token: SeManageVolumePrivilege	2236	TunnelBear-Installer.exe
Token: SeImpersonatePrivilege	2236	TunnelBear-Installer.exe
Token: SeCreateGlobalPrivilege	2236	TunnelBear-Installer.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	4884	srtasks.exe
Token: SeRestorePrivilege	4884	srtasks.exe
Token: SeSecurityPrivilege	4884	srtasks.exe
Token: SeTakeOwnershipPrivilege	4884	srtasks.exe
Token: SeBackupPrivilege	4884	srtasks.exe
Token: SeRestorePrivilege	4884	srtasks.exe
Token: SeSecurityPrivilege	4884	srtasks.exe
Token: SeTakeOwnershipPrivilege	4884	srtasks.exe
Token: SeDebugPrivilege	1212	rundll32.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
1880	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
1880	TunnelBear.UI.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
1880	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4072	TunnelBear.UI.exe
4988	Taskmgr.exe
4988	Taskmgr.exe
4988	Taskmgr.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
1836	chrome.exe
184	chrome.exe
184	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
184	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3488	1176	TunnelBear-Installer.exe	84
PID 1176 wrote to memory of 3488	1176	TunnelBear-Installer.exe	84
PID 1176 wrote to memory of 3488	1176	TunnelBear-Installer.exe	84
PID 3488 wrote to memory of 2236	3488	TunnelBear-Installer.exe	88
PID 3488 wrote to memory of 2236	3488	TunnelBear-Installer.exe	88
PID 3488 wrote to memory of 2236	3488	TunnelBear-Installer.exe	88
PID 2236 wrote to memory of 532	2236	TunnelBear-Installer.exe	98
PID 2236 wrote to memory of 532	2236	TunnelBear-Installer.exe	98
PID 2236 wrote to memory of 532	2236	TunnelBear-Installer.exe	98
PID 532 wrote to memory of 2120	532	vcredist140_x86.exe	100
PID 532 wrote to memory of 2120	532	vcredist140_x86.exe	100
PID 532 wrote to memory of 2120	532	vcredist140_x86.exe	100
PID 3892 wrote to memory of 3120	3892	msiexec.exe	103
PID 3892 wrote to memory of 3120	3892	msiexec.exe	103
PID 3892 wrote to memory of 3120	3892	msiexec.exe	103
PID 3120 wrote to memory of 1212	3120	MsiExec.exe	104
PID 3120 wrote to memory of 1212	3120	MsiExec.exe	104
PID 3120 wrote to memory of 1212	3120	MsiExec.exe	104
PID 1212 wrote to memory of 820	1212	rundll32.exe	105
PID 1212 wrote to memory of 820	1212	rundll32.exe	105
PID 1212 wrote to memory of 4688	1212	rundll32.exe	106
PID 1212 wrote to memory of 4688	1212	rundll32.exe	106
PID 820 wrote to memory of 3364	820	ie4uinit.exe	108
PID 820 wrote to memory of 3364	820	ie4uinit.exe	108
PID 820 wrote to memory of 1844	820	ie4uinit.exe	107
PID 820 wrote to memory of 1844	820	ie4uinit.exe	107
PID 3120 wrote to memory of 3340	3120	MsiExec.exe	110
PID 3120 wrote to memory of 3340	3120	MsiExec.exe	110
PID 3120 wrote to memory of 3340	3120	MsiExec.exe	110
PID 3120 wrote to memory of 4476	3120	MsiExec.exe	111
PID 3120 wrote to memory of 4476	3120	MsiExec.exe	111
PID 3120 wrote to memory of 4476	3120	MsiExec.exe	111
PID 3892 wrote to memory of 2980	3892	msiexec.exe	112
PID 3892 wrote to memory of 2980	3892	msiexec.exe	112
PID 3892 wrote to memory of 2980	3892	msiexec.exe	112
PID 2980 wrote to memory of 3728	2980	MsiExec.exe	114
PID 2980 wrote to memory of 3728	2980	MsiExec.exe	114
PID 2980 wrote to memory of 3728	2980	MsiExec.exe	114
PID 3728 wrote to memory of 512	3728	rundll32.exe	116
PID 3728 wrote to memory of 512	3728	rundll32.exe	116
PID 3728 wrote to memory of 512	3728	rundll32.exe	116
PID 2508 wrote to memory of 1992	2508	TunnelBear.Maintenance.exe	118
PID 2508 wrote to memory of 1992	2508	TunnelBear.Maintenance.exe	118
PID 2508 wrote to memory of 1992	2508	TunnelBear.Maintenance.exe	118
PID 1992 wrote to memory of 396	1992	cmd.exe	120
PID 1992 wrote to memory of 396	1992	cmd.exe	120
PID 1992 wrote to memory of 396	1992	cmd.exe	120
PID 2980 wrote to memory of 1844	2980	MsiExec.exe	121
PID 2980 wrote to memory of 1844	2980	MsiExec.exe	121
PID 2980 wrote to memory of 1844	2980	MsiExec.exe	121
PID 3120 wrote to memory of 2644	3120	MsiExec.exe	122
PID 3120 wrote to memory of 2644	3120	MsiExec.exe	122
PID 3120 wrote to memory of 2644	3120	MsiExec.exe	122
PID 2980 wrote to memory of 2156	2980	MsiExec.exe	123
PID 2980 wrote to memory of 2156	2980	MsiExec.exe	123
PID 2980 wrote to memory of 2156	2980	MsiExec.exe	123
PID 3488 wrote to memory of 800	3488	TunnelBear-Installer.exe	125
PID 3488 wrote to memory of 800	3488	TunnelBear-Installer.exe	125
PID 3488 wrote to memory of 800	3488	TunnelBear-Installer.exe	125
PID 800 wrote to memory of 1880	800	TunnelBear.exe	126
PID 800 wrote to memory of 1880	800	TunnelBear.exe	126
PID 800 wrote to memory of 1880	800	TunnelBear.exe	126
PID 2508 wrote to memory of 5080	2508	TunnelBear.Maintenance.exe	130
PID 2508 wrote to memory of 5080	2508	TunnelBear.Maintenance.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\Temp\{7A066889-73C2-441A-99CD-02A227DE3E83}\.cr\TunnelBear-Installer.exe
  "C:\Windows\Temp\{7A066889-73C2-441A-99CD-02A227DE3E83}\.cr\TunnelBear-Installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe" -burn.filehandle.attached=536 -burn.filehandle.self=512
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\Temp\{35202366-DAA6-440D-B75A-AC223BF639E4}\.be\TunnelBear-Installer.exe
    "C:\Windows\Temp\{35202366-DAA6-440D-B75A-AC223BF639E4}\.be\TunnelBear-Installer.exe" -q -burn.elevated BurnPipe.{C112AF50-43B9-4C10-BE16-0347FC980F46} {10536F44-F973-4068-B7F3-130A5F17CEC8} 3488
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\ProgramData\Package Cache\72211BD2E7DFC91EA7C8FAC549C49C0543BA791B\vcredist140_x86.exe
      "C:\ProgramData\Package Cache\72211BD2E7DFC91EA7C8FAC549C49C0543BA791B\vcredist140_x86.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\ProgramData\Package Cache\72211BD2E7DFC91EA7C8FAC549C49C0543BA791B\vcredist140_x86.exe
        
        "C:\ProgramData\Package Cache\72211BD2E7DFC91EA7C8FAC549C49C0543BA791B\vcredist140_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{C7DA08DA-2DA0-4ED4-99C2-23EB0D50F445} {CCCFE52A-9FE4-4B48-95AF-D0AF0DA2FB7E} 532
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2120
- - C:\Program Files (x86)\TunnelBear\TunnelBear.exe
    "C:\Program Files (x86)\TunnelBear\TunnelBear.exe" -createAccount
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Program Files (x86)\TunnelBear\TunnelBear.UI.exe
      "C:\Program Files (x86)\TunnelBear\TunnelBear.exe" -createAccount
      4⤵
      Executes dropped EXE
      Registers COM server for autorun
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C68F49A7CEBC6BE4B48A08C8DA7FA01
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI108A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240587609 2 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.PrepareInstall
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\system32\ie4uinit.exe
      "C:\Windows\Sysnative\ie4uinit.exe" -ClearIconCache
      4⤵
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        5⤵
        
        PID:1844
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        5⤵
        
        PID:3364
  - - C:\Windows\system32\ie4uinit.exe
      "C:\Windows\Sysnative\ie4uinit.exe" -Show
      4⤵
      Modifies Installed Components in the registry
      Registers COM server for autorun
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4688
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4DA6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240603031 14 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.DesktopConfiguration
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3340
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI53D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240604953 19 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.InstallCleanup
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:4476
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2E1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648937 35 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.SetInstallFolderPermissions
    3⤵
    - Drops file in Windows directory
    PID:2644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1D318EA98BA06455A2BD5F1E51CBA14 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDE50.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639671 25 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.InstallMaintenance
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe
      "C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe" -install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:512
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI169.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648593 30 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.LoadTunnelBearConfiguration
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1844
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI44A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240649296 40 TunnelBear.Setup.Actions!TBear.Setup.Actions.CustomActions.UninstallOldVersion
    3⤵
    - Drops file in Windows directory
    PID:2156

C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe
"C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc failure TunnelBearMaintenance reset= 0 actions= restart/0
    3⤵
    - Launches sc.exe
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:5080
- - C:\Program Files (x86)\TunnelBear\Bins\x64\tapinstall.exe
    tapinstall.exe install "C:\Program Files (x86)\TunnelBear\Drivers\x64\tap-tb-0901.inf" tap-tb-0901
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\sc.exe
    sc query polarbear-split-tunneling
    3⤵
    - Launches sc.exe
    PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:3700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Eaphost
1⤵
- Modifies data under HKEY_USERS
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2824
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "c:\program files (x86)\tunnelbear\drivers\x64\tap-tb-0901.inf" "9" "4f0f7913b" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000154" "208" "c:\program files (x86)\tunnelbear\drivers\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "201" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap-tb-0901.ndi:9.0.0.9:tap-tb-0901," "4f0f7913b" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff982f29758,0x7ff982f29768,0x7ff982f29778
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3340 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4832 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1844
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff60a937688,0x7ff60a937698,0x7ff60a9376a8
    3⤵
    PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5216 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3488 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4484 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4836 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3224 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5180 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2816 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4664 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5712 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5724 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5996 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6140 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6056 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6068 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6232 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3256 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5860 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6112 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5724 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6008 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6316 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6124 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6244 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2864 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6512 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6112 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6468 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=5840 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 --field-trial-handle=1840,i,13620137889199658766,10371906727996361451,131072 /prefetch:8
  2⤵
  PID:2836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3424

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x4d4
1⤵
PID:1600

C:\Program Files (x86)\TunnelBear\TunnelBear.exe
"C:\Program Files (x86)\TunnelBear\TunnelBear.exe"
1⤵
- Executes dropped EXE
PID:1944
- C:\Program Files (x86)\TunnelBear\TunnelBear.UI.exe
  "C:\Program Files (x86)\TunnelBear\TunnelBear.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4072

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:1636
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:4988

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:1808
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:3664
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  PID:2340

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:64
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery