File name:

qmk_toolbox.exe

Full analysis: https://app.any.run/tasks/d17fb14f-fe23-49b6-9220-274ef46c7b65
Verdict: Malicious activity
Analysis date: May 10, 2025, 22:56:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3856275C6170647E61D0B3F74279562B

SHA1:

E7300F62B3FC5D74FE03CA1934803908CFB54837

SHA256:

E373B643D42C843EC29DC1A0E2090D5AEEE21ADDD10259B16951B32E8C9D2FD3

SSDEEP:

98304:gY/PBwWF0o6PFOdWBF5jFoungqJ5ZdGuP9Yx0jVUtAXg8cdoGSNsvrRsm84I/I3B:KmJXbz2vY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 5728)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5216)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 5984)
      • installer_x64.exe (PID: 300)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)
      • installer_x64.exe (PID: 5544)
      • drvinst.exe (PID: 1132)
      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 300)
      • drvinst.exe (PID: 2040)
      • drvinst.exe (PID: 5124)

    • Drops a system driver (possible attempt to evade defenses)

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 5984)
      • installer_x64.exe (PID: 5544)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)
      • drvinst.exe (PID: 1132)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5728)

    • Process drops legitimate windows executable

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5436)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 1052)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 2040)

    • Reads security settings of Internet Explorer

      • qmk_driver_installer.exe (PID: 5936)
      • qmk_toolbox.exe (PID: 6048)

    • Adds/modifies Windows certificates

      • qmk_driver_installer.exe (PID: 5936)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

  • INFO

    • Creates files or folders in the user directory

      • qmk_toolbox.exe (PID: 6048)

    • Reads the computer name

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)

    • The sample compiled with english language support

      • qmk_driver_installer.exe (PID: 5936)
      • qmk_toolbox.exe (PID: 6048)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 6068)
      • installer_x64.exe (PID: 5728)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2040)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 2908)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • drvinst.exe (PID: 1132)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)
      • installer_x64.exe (PID: 5544)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 5124)

    • Reads the machine GUID from the registry

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

    • Process checks computer location settings

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)

    • Create files in a temporary directory

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

    • Creates files in the program directory

      • qmk_driver_installer.exe (PID: 5936)

    • Reads the software policy settings

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

    • Checks supported languages

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
      • qmk_toolbox.exe (PID: 6048)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (67.2)
.exe | Generic CIL Executable (.NET, Mono, etc.) (14)
.exe | Win32 EXE PECompact compressed (generic) (7.9)
.exe | Win64 Executable (generic) (5.2)
.scr | Windows screen saver (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:20 14:05:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 9024000
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x89d0de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.2.2.0
ProductVersionNumber: 0.2.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: A flashing/debug utility for devices running QMK Firmware
CompanyName: QMK
FileDescription: QMK Toolbox
FileVersion: 0.2.2
InternalName: qmk_toolbox.exe
LegalCopyright: Copyright © 2022 QMK
LegalTrademarks: -
OriginalFileName: qmk_toolbox.exe
ProductName: QMK Toolbox
ProductVersion: 0.2.2
AssemblyVersion: 0.2.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
248
Monitored processes
42
Malicious processes
4
Suspicious processes
8

Behavior graph

Click at the process to see the details
start qmk_toolbox.exe qmk_driver_installer.exe conhost.exe no specs installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
300DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{de6c60af-c77d-ed46-b129-52f30a01f2a0}\usb_device.inf" "9" "48ffb5c9f" "0000000000000214" "WinSta0\Default" "0000000000000218" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\newdev.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
1132DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5b0c38a5-3933-c148-8d91-5c7e6cee4a6b}\usb_device.inf" "9" "48ffb5c9f" "00000000000001E8" "WinSta0\Default" "00000000000001D0" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{067f78cc-4581-2f4d-9f9c-e4d47ed6555a}\usb_device.inf" "9" "48ffb5c9f" "0000000000000218" "WinSta0\Default" "0000000000000110" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2192DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{d721f319-21b0-0247-bdc8-e62000d62474}\usb_device.inf" "9" "48ffb5c9f" "00000000000001C4" "WinSta0\Default" "0000000000000210" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
116 650
Read events
115 024
Write events
794
Delete events
832

Modification events

(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0F0000000100000020000000DCE259E0B8E57A616A2D11EBBB9CB7BEA06EAB53AAD9F1917606AFE74D1CAD030B000000010000000E0000006C0069006200770064006900000002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E00650072000000000000000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0B000000010000000E0000006C00690062007700640069000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
Executable files
209
Suspicious files
116
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\avrdude.exeexecutable
MD5:CF7CE62462F68E034A0B1DC183B82181
SHA256:52B6151081A8224B0B031E096DDE2275D066E6912E5FE7A039652DC20871DFEA
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\libwinpthread-1.dllexecutable
MD5:26DBD2897E933930C8DF862B4927048A
SHA256:EB5A6B493B629E0230804F3E92575688B39A63EAF1D818A07E401312770C7A56
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\teensy_loader_cli.exeexecutable
MD5:813BAD976F950FA1ED4DDB42F775C8D3
SHA256:371DDA7DCEB8990F548832D62B65EDD5226B511590AD2350603C74600991EC9F
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\mdloader.exeexecutable
MD5:CA25343C5FC1E92213396052FEBE3187
SHA256:A38D2D013515E881923918CE0DE9F71595320D7F56C0B448FB7D6A2796232AB7
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\hid_bootloader_cli.exeexecutable
MD5:8ED55A63AD1739647A4096747523906F
SHA256:DC7052EDD8B11E49CFE4271D4EFD07DFFE95FE5FC53C3B05971F7C001DE22BD0
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset.eeptext
MD5:4D6A60FBFE6B19ACC66B0A094C072AD7
SHA256:A90A5A601E45ED336C5D6ECC20DD880372C9216EA3DC53266B69575F11E7E3AD
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\qmk_driver_installer.exeexecutable
MD5:410DDB45C34CE45CE54EA36165B831D8
SHA256:CCD78A40E3DB74A189F42E3EAB93463EF6C214C4F928B586992D70863B094431
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\libusb-0-1-4.dllexecutable
MD5:08685FA2AE49B7486878B7A519E5FB6C
SHA256:DD7C21F70F44CD04784AF794E6F38245A6DA7E48AB3FF7F75ED4943168A5F443
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\drivers.txttext
MD5:765827B2A94B8B9CEA958ADF91678D98
SHA256:5B4838254996CE76AC2F093604690EC4D7C1D797F2CA1D6DEC36751A3E08CEFF
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset_right.eeptext
MD5:F0C4FFC27E6837E37DFC960C8CDE8D6B
SHA256:E184F21C8FA2FF46C5C307EDE0C072466A4D3F37254143D48EF2A758E811AF98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
49
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
3216
svchost.exe
20.199.120.151:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.53.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
SE
whitelisted
6544
svchost.exe
104.78.173.167:80
ocsp.digicert.com
AKAMAI-AS
GB
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.18.121.147
whitelisted
google.com
  • 142.250.153.139
whitelisted
www.microsoft.com
  • 2.20.154.94
whitelisted
client.wns.windows.com
  • 20.199.120.151
whitelisted
login.live.com
  • 40.126.53.14
whitelisted
ocsp.digicert.com
  • 104.78.173.167
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
qmk_toolbox.exe