File name:

qmk_toolbox.exe

Full analysis: https://app.any.run/tasks/d17fb14f-fe23-49b6-9220-274ef46c7b65
Verdict: Malicious activity
Analysis date: May 10, 2025, 22:56:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3856275C6170647E61D0B3F74279562B

SHA1:

E7300F62B3FC5D74FE03CA1934803908CFB54837

SHA256:

E373B643D42C843EC29DC1A0E2090D5AEEE21ADDD10259B16951B32E8C9D2FD3

SSDEEP:

98304:gY/PBwWF0o6PFOdWBF5jFoungqJ5ZdGuP9Yx0jVUtAXg8cdoGSNsvrRsm84I/I3B:KmJXbz2vY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 4408)
      • installer_x64.exe (PID: 5728)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 5216)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5228)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 2040)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 5544)
      • drvinst.exe (PID: 1132)
      • drvinst.exe (PID: 2192)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 300)

    • Reads security settings of Internet Explorer

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)

    • Process drops legitimate windows executable

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 4408)
      • drvinst.exe (PID: 2040)

    • Drops a system driver (possible attempt to evade defenses)

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 5728)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 2908)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5228)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4620)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 1132)
      • installer_x64.exe (PID: 5544)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 5124)

    • Adds/modifies Windows certificates

      • qmk_driver_installer.exe (PID: 5936)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

  • INFO

    • Reads the machine GUID from the registry

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

    • Reads the computer name

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 5556)

    • Checks supported languages

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)

    • Creates files or folders in the user directory

      • qmk_toolbox.exe (PID: 6048)

    • The sample compiled with english language support

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • drvinst.exe (PID: 5384)
      • installer_x64.exe (PID: 5556)
      • drvinst.exe (PID: 5436)
      • installer_x64.exe (PID: 1052)
      • installer_x64.exe (PID: 5728)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 6192)
      • drvinst.exe (PID: 300)
      • installer_x64.exe (PID: 5216)
      • drvinst.exe (PID: 4408)
      • drvinst.exe (PID: 2040)
      • installer_x64.exe (PID: 300)
      • installer_x64.exe (PID: 5228)
      • drvinst.exe (PID: 2908)
      • drvinst.exe (PID: 5124)
      • installer_x64.exe (PID: 5984)
      • drvinst.exe (PID: 4152)
      • installer_x64.exe (PID: 6828)
      • drvinst.exe (PID: 4620)
      • drvinst.exe (PID: 1132)
      • installer_x64.exe (PID: 5544)
      • installer_x64.exe (PID: 6068)
      • drvinst.exe (PID: 2192)
      • installer_x64.exe (PID: 300)
      • drvinst.exe (PID: 5124)

    • Process checks computer location settings

      • qmk_toolbox.exe (PID: 6048)
      • qmk_driver_installer.exe (PID: 5936)

    • Create files in a temporary directory

      • qmk_driver_installer.exe (PID: 5936)
      • installer_x64.exe (PID: 3888)
      • installer_x64.exe (PID: 5556)

    • Creates files in the program directory

      • qmk_driver_installer.exe (PID: 5936)

    • Reads the software policy settings

      • qmk_driver_installer.exe (PID: 5936)
      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 5384)
      • drvinst.exe (PID: 5436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (67.2)
.exe | Generic CIL Executable (.NET, Mono, etc.) (14)
.exe | Win32 EXE PECompact compressed (generic) (7.9)
.exe | Win64 Executable (generic) (5.2)
.scr | Windows screen saver (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:20 14:05:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 9024000
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x89d0de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.2.2.0
ProductVersionNumber: 0.2.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: A flashing/debug utility for devices running QMK Firmware
CompanyName: QMK
FileDescription: QMK Toolbox
FileVersion: 0.2.2
InternalName: qmk_toolbox.exe
LegalCopyright: Copyright © 2022 QMK
LegalTrademarks: -
OriginalFileName: qmk_toolbox.exe
ProductName: QMK Toolbox
ProductVersion: 0.2.2
AssemblyVersion: 0.2.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
248
Monitored processes
42
Malicious processes
4
Suspicious processes
8

Behavior graph

Click at the process to see the details
start qmk_toolbox.exe qmk_driver_installer.exe conhost.exe no specs installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe installer_x64.exe conhost.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
300DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{de6c60af-c77d-ed46-b129-52f30a01f2a0}\usb_device.inf" "9" "48ffb5c9f" "0000000000000214" "WinSta0\Default" "0000000000000218" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
300"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\newdev.dll
c:\windows\system32\ucrtbase.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe" "usb_device.inf"C:\Users\admin\AppData\Local\Temp\qmk_driver\installer_x64.exe
qmk_driver_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qmk_driver\installer_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\newdev.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
1132DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5b0c38a5-3933-c148-8d91-5c7e6cee4a6b}\usb_device.inf" "9" "48ffb5c9f" "00000000000001E8" "WinSta0\Default" "00000000000001D0" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—installer_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{067f78cc-4581-2f4d-9f9c-e4d47ed6555a}\usb_device.inf" "9" "48ffb5c9f" "0000000000000218" "WinSta0\Default" "0000000000000110" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2192DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{d721f319-21b0-0247-bdc8-e62000d62474}\usb_device.inf" "9" "48ffb5c9f" "00000000000001C4" "WinSta0\Default" "0000000000000210" "208" "C:\Users\admin\AppData\Local\Temp\qmk_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
116 650
Read events
115 024
Write events
794
Delete events
832

Modification events

(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0F0000000100000020000000DCE259E0B8E57A616A2D11EBBB9CB7BEA06EAB53AAD9F1917606AFE74D1CAD030B000000010000000E0000006C0069006200770064006900000002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E00650072000000000000000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Operation:delete valueName:B3423A4F750899C1EC571C75B2476665DE4BC2E0
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
0B000000010000000E0000006C00690062007700640069000000030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E002000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C006900620077006400690000002000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:delete keyName:(default)
Value:
(PID) Process:(5936) qmk_driver_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B3423A4F750899C1EC571C75B2476665DE4BC2E0
Operation:writeName:Blob
Value:
030000000100000014000000B3423A4F750899C1EC571C75B2476665DE4BC2E02000000001000000CC020000308202C830820231A00302010202101EEDA345D5BF82B043D7960F91D7F6AE300D06092A864886F70D01010B050030633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E0065007200610074006500640029301E170D3235303531303232353632345A170D3239303130313030303030305A30633161305F06035504031E58005500530042005C005600490044005F00300034003800330026005000490044005F004400460031003100200028006C006900620077006400690020006100750074006F00670065006E006500720061007400650064002930819F300D06092A864886F70D010101050003818D0030818902818100B2DA40F0802858B936E109C0DABA46809A636B140399E34E96923AA94CD51773683C644B2C450B7E7A99E698A729B22100AB0E08B5DEB25BAB59A5D93A32FA92F058806D1AA6AA516C5362AD0C83D01EB30BD6EBAC7138F8725325F2CEC934143A87B60C599823CF37A6FBFF94330B944252960A002A06C068F884EB678695ED0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D01010B0500038181008A0F0B2DE149F724D3E57640087780672294AD41231DA9E1B58109E50EF0A9F149F20B0326644638D6362192ABDC1371BFB6827233DBB5994D34EA50A5CC7215D4451AF01C8E93461D926ABDA2A46BECE7B07ADBE32A52CCF04D236B51C5EBF10A49D03EDEE4B40245CE25F9475C2BFC1F65C0236D6729831FDFE4598B4001C8
Executable files
209
Suspicious files
116
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset.eeptext
MD5:4D6A60FBFE6B19ACC66B0A094C072AD7
SHA256:A90A5A601E45ED336C5D6ECC20DD880372C9216EA3DC53266B69575F11E7E3AD
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset_right.eeptext
MD5:F0C4FFC27E6837E37DFC960C8CDE8D6B
SHA256:E184F21C8FA2FF46C5C307EDE0C072466A4D3F37254143D48EF2A758E811AF98
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\reset_left.eeptext
MD5:F1E7A01721BD936DA66B20415955E561
SHA256:B9867FA2261C6BAD0BF5F0111BA18F5DEAEFF82400C33D55CF79CE8AB9FC02DB
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\dfu-programmer.exeexecutable
MD5:32630438E183D9E4D22B146A4DA2893E
SHA256:11E6E98C35504F3B5CC555A7184E8AE1F8304999549F8091F51499E871DDD5EB
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\dfu-util.exeexecutable
MD5:5C95E56A88FB8DA7564F2F51D7273526
SHA256:322FE732C47293B8B0FDECA510F2188F9D7A5136EF1A7900770DEB747FD9DD70
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\avrdude.exeexecutable
MD5:CF7CE62462F68E034A0B1DC183B82181
SHA256:52B6151081A8224B0B031E096DDE2275D066E6912E5FE7A039652DC20871DFEA
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\wb32-dfu-updater_cli.exeexecutable
MD5:D9AF6CD88011A9FA9998E89E44AE82A7
SHA256:6B47592A770607143FFB640F41E90AA0B16E9D2623D92857F8C4A53919C91F5B
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\teensy_loader_cli.exeexecutable
MD5:813BAD976F950FA1ED4DDB42F775C8D3
SHA256:371DDA7DCEB8990F548832D62B65EDD5226B511590AD2350603C74600991EC9F
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\bootloadHID.exeexecutable
MD5:2654F9208D1BD8C965B3B2A08CEE52CB
SHA256:15366F8D3FB5BDD8E4DD5E32F7DAF5B917D6A3F2E90D85EE0BD367B221D1112B
6048qmk_toolbox.exeC:\Users\admin\AppData\Local\QMK\QMK Toolbox\0.2.2\libwinpthread-1.dllexecutable
MD5:26DBD2897E933930C8DF862B4927048A
SHA256:EB5A6B493B629E0230804F3E92575688B39A63EAF1D818A07E401312770C7A56
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
49
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
3216
svchost.exe
20.199.120.151:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.53.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
SE
whitelisted
6544
svchost.exe
104.78.173.167:80
ocsp.digicert.com
AKAMAI-AS
GB
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.18.121.147
whitelisted
google.com
  • 142.250.153.139
whitelisted
www.microsoft.com
  • 2.20.154.94
whitelisted
client.wns.windows.com
  • 20.199.120.151
whitelisted
login.live.com
  • 40.126.53.14
whitelisted
ocsp.digicert.com
  • 104.78.173.167
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
qmk_toolbox.exe