thunderbird.exe
Thunderbird file version info
Program on Windows 4 known copies with hashes 3 Sigma rules name it
Is it the real thunderbird.exe?
C:\Program Files\Mozilla Thunderbird\4 known copies
91.3.0 · C:\Program Files\Mozilla Thunderbird\thunderbird.exe · signed by Mozilla Corporation
76179d2f4074a922be24ab942253d4562ef95066ab498786149eab40cdd9fee878.2.0 · C:\program files\Mozilla Thunderbird\thunderbird.exe · signed by Mozilla Corporation
60f7393b9fb767a7d720ff190da5f04153dfd465e3cb7fcb562b6acab5ba7d0678.2.0 · C:\Program Files\Mozilla Thunderbird\thunderbird.exe · signed by Mozilla Corporation
bc7bf8189c4dbbfc1f2adcf47264610f8f70a6f8f831a43498a6690693521fb578.1.0 · C:\Program Files\Mozilla Thunderbird\thunderbird.exe · signed by Mozilla Corporation
7de9159646ba055be7a7772ffed10a0fca889071f48e4bc8d3bf8d02ff7902e3From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names thunderbird.exe in 3 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.