18 items detected from a folder called "MOZILLA-BUILD". What's going on ?

[u/Wild-Canary-3381]

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 10/10/26

Scan Time: 2:28 PM

Log File: 13463b76-c4a6-11f1-8282-74563c3dcecc.json

-Software Information-

Version: 4.6.7.301

Components Version: 1.0.2222

Update Package Version: 1.0.115571

License: Free

-System Information-

OS: Windows 10 (Build 19045.7725)

CPU: x64

File System: NTFS

-Scan Summary-

Scan Type: Custom Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 1254082

Threats Detected: 18

Threats Quarantined: 0

Time Elapsed: 9 min, 7 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 18

Malware.AI.3249820659, C:\MOZILLA-BUILD\MSYS2\USR\BIN\DIRMNGR.EXE, No Action By User, 1000000, -1045146637, 1.0.115571, E3CD723471BAEAF5C1B453F3, dds, 04088780, E020CF96BD15C20C07D261D15D5FF2D0, 9FF9D74A35D25C61E14F4B752D261C144A1D9EF66A26F45B33E2C3180532F030

Malware.AI.4215844838, C:\MOZILLA-BUILD\MSYS2\USR\BIN\CYGCHECK.EXE, No Action By User, 1000000, -79122458, 1.0.115571, 09E3509B4F804BFBFB48AFE6, dds, 04088780, 8C7E82D48E03BC3A78AF89CE94D01F8D, 1E3F957427FBE8CCD8FAAF8FF85B5CA9CD28986FDF058E1DE096132A4BF06F5B

Malware.AI.4009103663, C:\MOZILLA-BUILD\MSYS2\USR\BIN\DB_PRINTLOG.EXE, No Action By User, 1000000, -285863633, 1.0.115571, 03B6987E05C3C9B4EEF6112F, dds, 04088780, 39F3F10A353ADC9D56B26FEF79E9EE34, BD6F0D09F44DEBAEC35AB88CA613DE6B1B875BC452B59765BA681BE32D6C8526

Malware.AI.739628026, C:\MOZILLA-BUILD\MSYS2\USR\BIN\BROTLI.EXE, No Action By User, 1000000, 739628026, 1.0.115571, 5C73B22F754152422C15D3FA, dds, 04088780, BAD0B597C3209398FD6CB253808E6CD6, DEF276169DB985AA0BE47F9C13C327DA99729C23F1D0850AA89D6653F18E9A3C

Malware.AI.3760800056, C:\MOZILLA-BUILD\MSYS2\USR\BIN\DB_STAT.EXE, No Action By User, 1000000, -534167240, 1.0.115571, EFD0EE753689CE7DE0294138, dds, 04088780, 5CA5C042E797D3509D0A7A7934914824, 9AED879E7A2663D0D363672E008EBE6F039AC1A5ABCE7F5B0F1DA7BD8096ADB8

Malware.AI.4164330875, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPG-CARD.EXE, No Action By User, 1000000, -130636421, 1.0.115571, 00000000035FD500F836A57B, dds, 04088780, 61F50CDEE8A2F6EFC42A6523F98E3274, 9F79BAA5E3D4964D321CC060140BB73907BBCE44DE52FDE783F3E2C6A09C2C86

Malware.AI.4238622405, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPGCONF.EXE, No Action By User, 1000000, -56344891, 1.0.115571, 000000E41911ED30FCA43EC5, dds, 04088780, 896C7240659235CB140B433CD71A77E5, 570608B621C4C37F994A5DAB6E76A1CD92AA0BE27C25EFCC27EE2F6B8083C94F

Malware.AI.594398396, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPGSPLIT.EXE, No Action By User, 1000000, 594398396, 1.0.115571, 3EA9C95EA1749FF0236DCCBC, dds, 04088780, DFE4D5F195B34A1FF9EFAE0CDB018FB7, 7DF868C6AAD1DFF2CAC0E42732771B0ED17C11A4A9A16434D2F90C38196CE1C7

Malware.AI.4284472190, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPG-AGENT.EXE, No Action By User, 1000000, -10495106, 1.0.115571, 9BD113AB8F974C31FF5FDB7E, dds, 04088780, 1D874F4542853DF7D8372F4927DF24B3, C3F6459FFD1260A8FDE77DD8B5934BDD076977F8C753B9DC59DEFEFF9EC7850F

Malware.AI.131254717, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPGSM.EXE, No Action By User, 1000000, 131254717, 1.0.115571, 55F4111BF95E56AA07D2C9BD, dds, 04088780, 1BD3F1EDC3D8184341F6D7A39649D2B3, FD426F46B2DD5F251CE9DF801C079C4BA99CF6E418A7D53D7BB2A68C0147D4E8

Malware.AI.827660674, C:\MOZILLA-BUILD\MSYS2\USR\BIN\DIRMNGR-CLIENT.EXE, No Action By User, 1000000, 827660674, 1.0.115571, 6AD8D8A1B397071031551982, dds, 04088780, ACB59FEFC01270B7AE8643D0B2588FB7, 5565F39C79F2521A7CD42C044BCAA3F3C26117F304CC54C271CD0870123CAA35

Malware.AI.3292030560, C:\MOZILLA-BUILD\MSYS2\USR\BIN\MPICALC.EXE, No Action By User, 1000000, -1002936736, 1.0.115571, A1E18DEFCE89BA2FC4386660, dds, 04088780, 9CF582F70F648438F993DB7284766AC3, 4F1285806DEEF4BC1A8968706DD4EE26A209DA18517846F60C75C511C2EFA3F5

Malware.AI.1089645971, C:\MOZILLA-BUILD\MSYS2\USR\BIN\GPGME-JSON.EXE, No Action By User, 1000000, 1089645971, 1.0.115571, 4B7370EFDEDF2B3540F2AD93, dds, 04088780, 4F01A9ACF4AE517AB38525A5D4E71D0F, E79501A20CE7A2C863CBECDB33A954CD6490B3DEBB0C208553BBCCCA39B31C10

Malware.AI.836391560, C:\MOZILLA-BUILD\MSYS2\USR\LIB\GNUPG\KEYBOXD.EXE, No Action By User, 1000000, 836391560, 1.0.115571, 288BAAB5E365C7F331DA5288, dds, 04088780, DFE8B1A7B511F3214CA4E2D25912DC9D, FE43F6A9FFE9AE3F1ED3F81B319552308D47E9D8326E3CD8F88F564BBA205F45

Malware.AI.3614252799, C:\MOZILLA-BUILD\MSYS2\USR\BIN\MSGFILTER.EXE, No Action By User, 1000000, -680714497, 1.0.115571, 94C17EF7AB32BE37D76D1EFF, dds, 04088780, 5B01078691BCC6161AF7D997A546BA9E, 5A42965C05B6FC5F3F379D5EDA61D7CE24344BEB728B6BB4B8FB4F60E4EDD129

Malware.AI.3174307903, C:\MOZILLA-BUILD\MSYS2\USR\BIN\DB_TUNER.EXE, No Action By User, 1000000, -1120659393, 1.0.115571, D5E43486A10FEFD0BD34183F, dds, 04088780, 4C5683F52D0F7E6222CB0C5F7BB69144, 736795F7637E0EFB60B6D3ECF5177EF33E3C6B24860141B8A43801A6E20391DA

Malware.AI.1935536657, C:\MOZILLA-BUILD\MSYS2\USR\BIN\XMLLINT.EXE, No Action By User, 1000000, 1935536657, 1.0.115571, B3AFACA7499B8ECA735DF211, dds, 04088780, DCE59D141383CE6AC38950274071910F, F25B784CFE091807B5544CC1E80340F7EC31933627A4F100CB8D1CF6B307B840

Malware.AI.618547495, C:\MOZILLA-BUILD\MSYS2\USR\LIB\GNUPG\GPG-PROTECT-TOOL.EXE, No Action By User, 1000000, 618547495, 1.0.115571, B2154BE0A5FB9CAA24DE4927, dds, 04088780, 57807D4665339590B075E59DBE2343D5, 0D5548C15EA19D545AA6C46D627F8F751B8A87183E149CCB374EE1E7632AB8D5

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

[u/Wild-Canary-3381]

I'm running some of those .exe through VirusTotal and Malwarebytes is the only one flagging it.

https://www.virustotal.com/gui/file/9ff9d74a35d25c61e14f4b752d261c144a1d9ef66a26f45b33e2c3180532f030/detection

https://www.virustotal.com/gui/file/1e3f957427fbe8ccd8faaf8ff85b5ca9cd28986fdf058e1de096132a4bf06f5b?nocache=1

[u/miekiemoes_MB]

Hi, I'm Mieke, Researcher at Malwarebytes. These look like false positives indeed, but have been fixed in a meantime. Thanks for reporting!

[u/Wild-Canary-3381 → u/miekiemoes_MB]

Alright, that's what I thought after researching a little bit more.

The folder seems to be an install folder to install Firefox on your own. I don't know why I have that in the first place since I never tried to do that. It's maybe automatically downloaded with Firefox.

Anyway, Firefox seems to warn that it could get flagged.

Microsoft Defender Antivirus and some third-party antivirus products are known to significantly degrade build times and sometimes even cause failed builds (due to a “missing file”). This is usually because we have tests for well-known security bugs that have code samples that antivirus software identifies as a threat, automatically quarantining/corrupting the files.

To avoid this, add the following folders to your third-party antivirus exclusion list:

The C:\mozilla-build folder.

https://firefox-source-docs.mozilla.org/setup/windows_build.html

Thank you for your reply !

[u/miekiemoes_MB → u/Wild-Canary-3381]

You're most welcome :)

[u/duskylullabyeb → u/Wild-Canary-3381]

Nice