File name:

qmk_toolbox.exe

Full analysis: https://app.any.run/tasks/d17fb14f-fe23-49b6-9220-274ef46c7b65
Verdict: Malicious activity
Analysis date: May 10, 2025, 22:56:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3856275C6170647E61D0B3F74279562B

SHA1:

E7300F62B3FC5D74FE03CA1934803908CFB54837

SHA256:

E373B643D42C843EC29DC1A0E2090D5AEEE21ADDD10259B16951B32E8C9D2FD3

SSDEEP:

98304:gY/PBwWF0o6PFOdWBF5jFoungqJ5ZdGuP9Yx0jVUtAXg8cdoGSNsvrRsm84I/I3B:KmJXbz2vY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 2040)

    • Executable content was dropped or overwritten

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • qmk_toolbox.exe (PID: 6048)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5728)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 2040)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 5544)
      • drvinst.exe (PID: 1132)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 300)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)

    • Drops a system driver (possible attempt to evade defenses)

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 5728)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 6828)
      • installer_x64.exe (PID: 6068)
      • installer_x64.exe (PID: 5544)
      • drvinst.exe (PID: 1132)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 2192)

    • Reads security settings of Internet Explorer

      • qmk_driver_installer.exe (PID: 5936)
      • qmk_toolbox.exe (PID: 6048)

    • Adds/modifies Windows certificates

      • qmk_driver_installer.exe (PID: 5936)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

  • INFO

    • Reads the computer name

      • qmk_toolbox.exe (PID: 6048)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5436)

    • Creates files or folders in the user directory

      • qmk_toolbox.exe (PID: 6048)

    • The sample compiled with english language support

      • qmk_driver_installer.exe (PID: 5936)
      • qmk_toolbox.exe (PID: 6048)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5728)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 300)
      • drvinst.exe (PID: 2040)
      • installer_x64.exe (PID: 300)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 2908)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 6068)
      • installer_x64.exe (PID: 5544)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 1132)
      • drvinst.exe (PID: 2192)
      • drvinst.exe (PID: 5124)

    • Process checks computer location settings

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)

    • Create files in a temporary directory

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

    • Creates files in the program directory

      • qmk_driver_installer.exe (PID: 5936)

    • Reads the machine GUID from the registry

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • qmk_toolbox.exe (PID: 6048)
      • drvinst.exe (PID: 5436)

    • Reads the software policy settings

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

    • Checks supported languages

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • qmk_toolbox.exe (PID: 6048)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (67.2)
.exe | Generic CIL Executable (.NET, Mono, etc.) (14)
.exe | Win32 EXE PECompact compressed (generic) (7.9)
.exe | Win64 Executable (generic) (5.2)
.scr | Windows screen saver (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:20 14:05:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 9024000
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x89d0de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.2.2.0
ProductVersionNumber: 0.2.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: A flashing/debug utility for devices running QMK Firmware
CompanyName: QMK
FileDescription: QMK Toolbox
FileVersion: 0.2.2
InternalName: qmk_toolbox.exe
LegalCopyright: Copyright © 2022 QMK
LegalTrademarks: -
OriginalFileName: qmk_toolbox.exe
ProductName: QMK Toolbox
ProductVersion: 0.2.2
AssemblyVersion: 0.2.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
248
Monitored processes
42
Malicious processes
4
Suspicious processes
8

Behavior graph

Click at the process to see the details
start qmk_toolbox.exe qmk_driver_installer.exe conhost.exe no specs installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
300DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{de6c60af-c77d-ed46-b129-52f30a01f2a0}\usb_device.inf" "9" "48ffb5c9f" "0000000000000214" "WinSta0\Default" "0000000000000218" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\newdev.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
1132DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5b0c38a5-3933-c148-8d91-5c7e6cee4a6b}\usb_device.inf" "9" "48ffb5c9f" "00000000000001E8" "WinSta0\Default" "00000000000001D0" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{067f78cc-4581-2f4d-9f9c-e4d47ed6555a}\usb_device.inf" "9" "48ffb5c9f" "0000000000000218" "WinSta0\Default" "0000000000000110" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2192DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{d721f319-21b0-0247-bdc8-e62000d62474}\usb_device.inf" "9" "48ffb5c9f" "00000000000001C4" "WinSta0\Default" "0000000000000210" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
116 650
Read events
115 024
Write events
794
Delete events
832

Modification events

(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0F0000000100000020000000DCE259E0B8E57A616A2D11EBBB9CB7BEA06EAB53AAD9F1917606AFE74D1CAD030B000000010000000E0000006C0069006200770064006900000002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E00650072000000000000000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0B000000010000000E0000006C00690062007700640069000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
Executable files
209
Suspicious files
116
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\avrdude.exeexecutable
MD5:CF7CE62462F68E034A0B1DC183B82181
SHA256:52B6151081A8224B0B031E096DDE2275D066E6912E5FE7A039652DC20871DFEA
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\bootloadHID.exeexecutable
MD5:2654F9208D1BD8C965B3B2A08CEE52CB
SHA256:15366F8D3FB5BDD8E4DD5E32F7DAF5B917D6A3F2E90D85EE0BD367B221D1112B
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\dfu-programmer.exeexecutable
MD5:32630438E183D9E4D22B146A4DA2893E
SHA256:11E6E98C35504F3B5CC555A7184E8AE1F8304999549F8091F51499E871DDD5EB
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\mdloader.exeexecutable
MD5:CA25343C5FC1E92213396052FEBE3187
SHA256:A38D2D013515E881923918CE0DE9F71595320D7F56C0B448FB7D6A2796232AB7
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\teensy_loader_cli.exeexecutable
MD5:813BAD976F950FA1ED4DDB42F775C8D3
SHA256:371DDA7DCEB8990F548832D62B65EDD5226B511590AD2350603C74600991EC9F
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset_right.eeptext
MD5:F0C4FFC27E6837E37DFC960C8CDE8D6B
SHA256:E184F21C8FA2FF46C5C307EDE0C072466A4D3F37254143D48EF2A758E811AF98
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\libusb-0-1-4.dllexecutable
MD5:08685FA2AE49B7486878B7A519E5FB6C
SHA256:DD7C21F70F44CD04784AF794E6F38245A6DA7E48AB3FF7F75ED4943168A5F443
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\libftdi1.dllexecutable
MD5:380709ABD0EB35776145A40B959F8DA1
SHA256:FBE971520A0E2502AC8DD64C3A414B6CD29F729853A656E27AD0D0F01DE43BB6
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\avrdude.conftext
MD5:908BF00CDB8CCB348437A01212477E91
SHA256:FAD983D9DC324F3B99CDC7CD41538F3A3FA1929031C184E1C1418EBFA1EC5947
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\hid_bootloader_cli.exeexecutable
MD5:8ED55A63AD1739647A4096747523906F
SHA256:DC7052EDD8B11E49CFE4271D4EFD07DFFE95FE5FC53C3B05971F7C001DE22BD0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
49
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
3216
svchost.exe
20.199.120.151:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.53.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
SE
whitelisted
6544
svchost.exe
104.78.173.167:80
ocsp.digicert.com
AKAMAI-AS
GB
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.18.121.147
whitelisted
google.com
  • 142.250.153.139
whitelisted
www.microsoft.com
  • 2.20.154.94
whitelisted
client.wns.windows.com
  • 20.199.120.151
whitelisted
login.live.com
  • 40.126.53.14
whitelisted
ocsp.digicert.com
  • 104.78.173.167
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
qmk_toolbox.exe