Kyndred_1[.]0[.]0_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Kyndred_1.0.0_x64-setup.exe
Size 23.6MB
Sample261027-mapfesb18y
SHA256 329ba23f82783153f37c52ab1f4845688dd839a3b0a3a9f41996067da51f1576
MD5 3217f06470ac6c21aa679cd7cad12c27
SHA1 585b94fdd1416054aaea09d039ae6eeb2e5a4a36
SHA512 30fb9a07cf12e6b8f1b3afe916a11ad9d758bffc117fa1ca4583d6401f982e953489594db38a55c61ba4459b9e604e119fde3884f1667c7a53d0b6930216697e
SSDEEP 393216:0n6wxGztVx18aUUfqY2rsYEo3byM0mTAx2ZFpjYLi/PtqTd/Ik0mP/PgXV:06w+1GY2rsGbeiZ0u/PkTPP/PCV
TLSH
T13F4733A58281CF26F0879CB98955B0109B3F0B1F02A93B5BB3116579E7E38F83936D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

Kyndred_1.0.0_x64-setup.exe

.exe 23.6MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 29KB
Kyndred.exe

.exe 31.2MB
frame_bench.exe

.exe 2.6MB

Kyndred_1.0.0_x64-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 329ba23f82783153f37c52ab1f4845688dd839a3b0a3a9f41996067da51f1576
MD5 3217f06470ac6c21aa679cd7cad12c27
SHA1 585b94fdd1416054aaea09d039ae6eeb2e5a4a36
SHA512 30fb9a07cf12e6b8f1b3afe916a11ad9d758bffc117fa1ca4583d6401f982e953489594db38a55c61ba4459b9e604e119fde3884f1667c7a53d0b6930216697e
SSDEEP 393216:0n6wxGztVx18aUUfqY2rsYEo3byM0mTAx2ZFpjYLi/PtqTd/Ik0mP/PgXV:06w+1GY2rsGbeiZ0u/PkTPP/PCV
TLSH
T13F4733A58281CF26F0879CB98955B0109B3F0B1F02A93B5BB3116579E7E38F83936D57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

2c:f7:61:b2:53:f9:98:9a:2d:3d:a1:0a:5f:38:12:e4:02:fd:f4:f4:7d:8f:e4:33:e5:4c:59:a1:05:3e:fb:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Chains

Oct 21, 2026

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Serial Number

33:00:08:c8:05:f0:97:b5:83:05:44:b4:30:00:00:00:08:c8:05

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2026 - Oct 23, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Kyndred.exe

IMPHASH 5820633373c4812a7ae776aef5f28a0f
SHA256 e7b25b9dd099d924ae7c827afd084554ae55808954b5bda61e1dcbcdcfc9d31f
MD5 c5014ef5d9829cf6ae0faf8d396b0f3b
SHA1 198fe283e171604a29eb1f553c15ccf8a17efb81
SHA512 ef68925ca474005efb230b8bf5074a4fd4a56452ba7d9e1d88275e38c65b5e5371202f4052203aab4912e083cdf6f21879c52841ce56a119068ebab13a4e8aa9
SSDEEP 393216:0p1++srjAPmSER/1o3QtYA6kHeM/K7EJo9qWKuatt3CuwBwvTfJbgsq:07++sUm/11o0Y3KD/NJtWKZPQwbE
TLSH
T11777DF217B9A996DD05AC47083868A725B3170DB0B35BAFF44D446393FBDAF81F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

3b:76:5a:53:5c:05:cc:09:07:6b:c4:84:1c:b3:9e:e8:56:81:d6:44:8c:7a:48:02:9a:75:da:97:67:e5:97:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Chains

Oct 21, 2026

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Serial Number

33:00:08:c8:05:f0:97:b5:83:05:44:b4:30:00:00:00:08:c8:05

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2026 - Oct 23, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

8062704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kyndred_desktop.pdb

kernel32

CloseHandle GetModuleHandleW ReleaseMutex OpenProcess QueryFullProcessImageNameW GetCurrentThreadId GetTickCount SetEvent CreateMutexW GetLastError GetCurrentProcessId CreateEventA InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive DeleteCriticalSection GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer MultiByteToWideChar GetCurrentProcess LoadLibraryExW GetModuleFileNameW GetFileAttributesW SetEnvironmentVariableW DeleteFileW GetProcAddress CreateSymbolicLinkW GetFinalPathNameByHandleW SetHandleInformation CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess CreateHardLinkW LoadLibraryA WaitForMultipleObjectsEx SetThreadPriority WaitForSingleObject CreateEventW WaitForMultipleObjects GetTempPathW GetModuleHandleA OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus GetOverlappedResult ReadFile CreateIoCompletionPort WriteConsoleW GetQueuedCompletionStatusEx FreeLibrary SetFileCompletionNotificationModes GetFileInformationByHandle GetConsoleMode SetFileAttributesW MoveFileExW Sleep LoadLibraryW FindClose GetEnvironmentVariableW CompareStringOrdinal FormatMessageW FreeEnvironmentStringsW FindFirstFileExW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency GetCommandLineW HeapFree GetCurrentDirectoryW HeapAlloc GetProcessHeap GetCurrentThread QueryPerformanceCounter CreateThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW ReadFileEx RtlVirtualUnwind LoadLibraryExA DuplicateHandle RtlCaptureContext FindNextFileW RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetStdHandle GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW LCIDToLocaleName GetUserDefaultUILanguage CreateProcessW GetExitCodeProcess lstrlenW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

AdjustWindowRectEx IsProcessDPIAware GetDC CreateMenu CheckMenuItem CreatePopupMenu UnregisterHotKey VkKeyScanW GetKeyState GetKeyboardState MapVirtualKeyExW DestroyIcon DestroyAcceleratorTable GetMenu GetRawInputData SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow ShowCursor ClipCursor GetClipCursor RegisterRawInputDevices SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA EnumChildWindows SystemParametersInfoA SetForegroundWindow TrackPopupMenu GetKeyboardLayout SendInput UnhookWinEvent SetWinEventHook GetSystemMetrics ReleaseCapture CloseTouchInputHandle GetTouchInputInfo GetActiveWindow MapVirtualKeyW PostQuitMessage DispatchMessageA GetLastInputInfo GetDpiForWindow GetAwarenessFromDpiAwarenessContext GetWindowDpiAwarenessContext GetAsyncKeyState GetMessageA WindowFromPoint SendMessageTimeoutW ClientToScreen GetGUIThreadInfo SetWindowLongPtrW GetWindowLongPtrW GetAncestor GetCursorPos GetWindowDisplayAffinity GetWindowTextW GetWindowThreadProcessId IsWindow MonitorFromWindow CreateIcon SetWindowTextW SetMenuItemInfoW GetForegroundWindow DestroyWindow DefWindowProcW CreateWindowExW AppendMenuW RegisterClassExW DisplayConfigGetDeviceInfo QueryDisplayConfig ToUnicodeEx GetDisplayConfigBufferSizes RegisterHotKey GetDesktopWindow ReleaseDC GetWindowDC EnumDisplaySettingsW EnumDisplayMonitors ScreenToClient GetWindowTextLengthW PostMessageW CreateAcceleratorTableW SetTimer EnumWindows GetWindowRect SetCursorPos GetUpdateRect ValidateRect MonitorFromRect GetWindowLongW SetMenu SetCursor LoadCursorW InvalidateRgn SetWindowPlacement SetWindowPos GetWindowPlacement PeekMessageW ChangeDisplaySettingsExW FlashWindowEx RedrawWindow PostThreadMessageW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW SetWindowDisplayAffinity RegisterClassW SendMessageW FindWindowW GetMonitorInfoW GetClassNameW MonitorFromPoint IsIconic IsWindowVisible GetClientRect TrackMouseEvent RegisterTouchWindow

advapi32

CredWriteW EventUnregister SystemFunction036 CredDeleteW RegSetValueExW RegDeleteValueW RegOpenKeyExW RegCloseKey RegQueryValueExW EventSetInformation CredReadW EventRegister EventWriteTransfer CredFree RegGetValueW

gdi32

GetDeviceCaps DeleteDC GetDIBits BitBlt CreateCompatibleDC CreateRectRgn CreateCompatibleBitmap SelectObject DeleteObject

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ole32

CoCreateInstance CoInitializeEx CoEnableCallCancellation CreateStreamOnHGlobal CoUninitialize CoCancelCall RevokeDragDrop CoTaskMemAlloc OleInitialize CoTaskMemFree PropVariantClear RegisterDragDrop CoIncrementMTAUsage

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo VariantClear

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtCancelIoFileEx NtOpenFile NtDeviceIoControlFile NtCreateFile NtWriteFile

bcryptprimitives

ProcessPrng

ws2_32

select WSADuplicateSocketW shutdown listen bind WSASocketW WSAIoctl WSAStartup connect ioctlsocket getsockopt accept getpeername getsockname send WSASend recv WSARecv WSAGetLastError setsockopt closesocket getaddrinfo freeaddrinfo WSACleanup

bcrypt

BCryptGenRandom

secur32

AcquireCredentialsHandleA ApplyControlToken DecryptMessage EncryptMessage AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle

crypt32

CertOpenStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertGetCertificateChain CertVerifyCertificateChainPolicy

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleacc

ObjectFromLresult

shell32

SHQueryUserNotificationState SHAppBarMessage ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconW DragFinish Shell_NotifyIconGetRect DragQueryFileW

comctl32

DefSubclassProc RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass

uxtheme

SetWindowTheme

api-ms-win-crt-math-l1-1-0

floorf expf sinf roundf trunc round pow ceilf __setusermatherr floor

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s strlen

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function abort _initialize_narrow_environment terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_onexit_table _get_initial_narrow_environment _exit _initterm _initterm_e exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

frame_bench.exe

IMPHASH d15f0f7696568ccf5d68ada60ab505f8
SHA256 ba4e93a6c6dd62ac6750e0710bfba1f6266769d61113dfd72f155e37e11fbfa7
MD5 87660546254af6cb94d47d69215bae80
SHA1 e8c613fba6cc9ecadaf62a4c2dd3b6ce4c9e26cb
SHA512 a2227aade68c53837adf4bd6670b921e3b6415533425883c60d8cc72032c41009177b5c378edc88bf8c704a697c67872c460bcffc3da20870ef9a01d82b2cd63
SSDEEP 49152:b28+2/mAfXHyn5bNmvVbsqzORrQ7iT1hPJgnVJw:tunnOiqQT1hPmVi
TLSH
T1EED52901FA4B59ECD19AC47083464A625B35B4CA0B31BAFF129485353FBABF01F78799
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ac:5f:a2:de:09:84:9c:22:0f:97:23:15:f7:5e:82:e2:ed:d7:01:1d:f5:1a:05:8e:f0:b9:ed:78:02:18:a1:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Chains

Oct 21, 2026

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=InfoNowMeditatii SRL,O=InfoNowMeditatii SRL,L=Tecuci,ST=Galati,C=RO

Serial Number

33:00:08:c8:05:f0:97:b5:83:05:44:b4:30:00:00:00:08:c8:05

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2026 - Oct 23, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

1700448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

frame_bench.pdb

advapi32

RegGetValueW

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

kernel32

HeapFree GetProcessHeap FreeLibrary GetModuleHandleA GetModuleFileNameW GetLastError GetProcAddress CloseHandle GetCurrentProcess LoadLibraryA RaiseException GetFileInformationByHandle FindNextFileW GetCurrentProcessId GetConsoleMode SetWaitableTimer RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead EncodePointer CreateWaitableTimerExW FlsFree FlsSetValue FlsGetValue GetConsoleOutputCP WriteConsoleW MultiByteToWideChar HeapAlloc WaitForSingleObject DeleteFileW FlsAlloc GetCurrentThreadId GetFinalPathNameByHandleW ReleaseMutex CreateMutexA GetModuleHandleW WaitForSingleObjectEx LoadLibraryExA WideCharToMultiByte FormatMessageW QueryFullProcessImageNameW OpenProcess GetSystemTimeAsFileTime FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW lstrlenW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetStdHandle SetEvent GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry DeleteCriticalSection RtlCaptureContext Sleep InitializeCriticalSectionEx GetEnvironmentVariableW CreateEventW SetLastError GetFullPathNameW QueryPerformanceCounter MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

oleaut32

SysStringLen GetErrorInfo SysFreeString

user32

GetDesktopWindow ReleaseDC GetWindowDC EnumDisplaySettingsW GetMonitorInfoW GetWindowTextW GetWindowThreadProcessId GetForegroundWindow EnumDisplayMonitors

gdi32

CreateCompatibleBitmap CreateCompatibleDC BitBlt GetDIBits DeleteObject DeleteDC SelectObject

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ole32

CoIncrementMTAUsage

api-ms-win-crt-math-l1-1-0

sinf ceilf expf floorf __setusermatherr roundf round

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initterm_e exit _exit __p___argc __p___argv _initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe _initialize_onexit_table _get_initial_narrow_environment terminate _initterm abort _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

Kyndred_1.0.0_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

generic

Kyndred.exe

kernel32

api-ms-win-core-synch-l1-2-0

user32

advapi32

gdi32

dwmapi

api-ms-win-core-winrt-l1-1-0

ole32

oleaut32

ntdll

bcryptprimitives

ws2_32

bcrypt

secur32

crypt32

api-ms-win-shcore-scaling-l1-1-1

oleacc

shell32

comctl32

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

frame_bench.exe

advapi32

ntdll

kernel32