CmdID

CmdID / Files

updater.exe

Firefox Software Updater file version info

Program on Windows 9 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real updater.exe?

file version info and known copies
Installed inC:\Program Files\Mozilla Firefox\
C:\Program Files\Mozilla Thunderbird\
C:\Program Files\CDBurnerXP\
Signed byMozilla Corporation
ProductFirefox, Mozilla Foundation
DescriptionFirefox Software Updater

9 known copies

94.0.1 · C:\Program Files\Mozilla Firefox\updater.exe · signed by Mozilla Corporation

43ce5237022ecf582cf259d0b6c9c84b54c90111195c9eb4fa4d24b2d257c410

91.3.0 · C:\Program Files\Mozilla Thunderbird\updater.exe · signed by Mozilla Corporation

5338ec0fb975f7344cee719fdcb8bd08b4d04f259d5ef3bbeb2715f74b5ad2ee

81.0 · C:\Program Files\Mozilla Firefox\updater.exe · signed by Mozilla Corporation

a8393b5c7e98f4102ae599fb337003782cef5ee7fd48af20c647518cc08a3733

80.0 · C:\program files\Mozilla Firefox\updater.exe · signed by Mozilla Corporation

e87d2764193e4f38ef1eff94f4569883a9dd729be388bb032deaac51a2b86e82

79.0 · C:\Program Files\Mozilla Firefox\updater.exe · signed by Mozilla Corporation

cfb294a55e9da897508f8c7a9c048cdd68d8a49bd4f1215171136424e24d9900

78.2.0 · C:\program files\Mozilla Thunderbird\updater.exe · signed by Mozilla Corporation

3d51d4318551a9e1aeae088414953e6b633a09746236b8d7e001164d247fa88d

78.2.0 · C:\Program Files\Mozilla Thunderbird\updater.exe · signed by Mozilla Corporation

72c6828a8b72e664f66f28cb64250c64a86caaae276fab3d75839b30d70e5b3f

78.1.0 · C:\Program Files\Mozilla Thunderbird\updater.exe · signed by Mozilla Corporation

7dc408d6fb2a0840334f05fd87d5c8c4b04f60f3a09c6afb6cf53881698cfb58

4.5.8.7128 · C:\Program Files\CDBurnerXP\updater.exe · signed by Canneverbe Limited

d552a297a9393ea9a0aad2b5649d7d7749d9a098ecb8cde0823c3674024a28ce

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names updater.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.