EchoTrail

Kimi Code 1.2.0

by Moonshot AIinstaller signed by NOVASCENT PRIVATE LIMITEDValid

Sources: observed in the EchoTrail lab on Windows 11 on October 29, 2026.

The install

Installer
kimicode-win-x64.exe
Installer type
nsis
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\Programs
Launched
Kimi Code.exe
Windows
Windows 11
Date
October 29, 2026
Executables dropped
21

installer sha256 f02e73e70c34b4c10a25736c49698738a3f5c6420ae256647bb4d589330ecd21

The lab used Kimi Code for 1 minute, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Kimi Code's own windows.

Kimi Code 1.2.0: First window
First window. Welcome screen of Kimi Code with language and appearance options and a Continue button.
Kimi Code 1.2.0: Main window
Main window. Kimi Code main window is showing with an empty session, a sidebar, a message box and a Settings gear at the bottom left.
Kimi Code 1.2.0: Settings
Settings. Settings dialog is open on the General tab showing Appearance, Language, and Font size options.
Kimi Code 1.2.0: First window
First window. Configure Model screen offers sign-in options, a custom provider, Back and Skip for now.

What it dropped

Executables

  • kimi code.exesigned by CN=NOVASCENT PRIVATE LIMITED, O=NOVASCENT PRIVATE LIMITED, L=Singapore, C=SGValidran during the lab session
    C:\Users\lab\AppData\Local\Programs\Kimi Code\Kimi Code.exe
    sha256 44037fcf967c3ba489920415415606b2886855097a653f549058c228093f86da
  • installer.exesigned by CN=NOVASCENT PRIVATE LIMITED, O=NOVASCENT PRIVATE LIMITED, L=Singapore, C=SGValid
    C:\Users\lab\AppData\Local\kimi-code-app-updater\installer.exe
    sha256 f02e73e70c34b4c10a25736c49698738a3f5c6420ae256647bb4d589330ecd21
  • dxcompiler.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Kimi Code\dxcompiler.dll
    sha256 a26f279fb9e49fef94d60710a8371f5f9cbeac73d92d6ad072a664c9c4442213
  • libglesv2.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Kimi Code\libGLESv2.dll
    sha256 d254bf59b7e56730e56f58061ba83f0e75c0b393c4879a64560cc867d1f8e7f3
  • vk_swiftshader.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\vk_swiftshader.dll
    sha256 0fc94c88bf7cedaf866da5c959a1c52fd1b8ddb2d72185bd8fa2843fe9112e7c
  • d3dcompiler_47.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\Kimi Code\d3dcompiler_47.dll
    sha256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
  • ffmpeg.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Kimi Code\ffmpeg.dll
    sha256 eaeb2203f72d89615ffbf6a38bb96860cc78a9095126b790e36fc91c8f1fef3d
  • dxil.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\Kimi Code\dxil.dll
    sha256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
  • openconsole.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\OpenConsole.exe
    sha256 d6f77b343b9bcb6288eefaa269ea5be3780ee77025c30134594d50fc5a964dc0
  • openconsole.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\prebuilds\win32-x64\conpty\OpenConsole.exe
    sha256 304f748573e2e68a2820908dc94abcf74b95f297a569a5dabd5878204aaee117
  • vulkan-1.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\vulkan-1.dll
    sha256 1843299ee154fc50d6d11ff5918742852d70467385e10b7a1019ea3358f3085a
  • libegl.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Kimi Code\libEGL.dll
    sha256 0c2960b094a77dba406e1401c6dcdc35245f218c7b910062d51cfac0f4898830
  • winpty-agent.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\build\Release\winpty-agent.exe
    sha256 c1ddac3326b70dd34c84f88f9736e250a639a342ed5287b951a021cd20f74ebe
  • winpty-agent.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\prebuilds\win32-x64\winpty-agent.exe
    sha256 491232a0dbcc17089192c775fb470e29c2c9b078034c068c173e144c2bd687a2
  • screenshot-window-list.exesigned by CN=NOVASCENT PRIVATE LIMITED, O=NOVASCENT PRIVATE LIMITED, L=Singapore, C=SGValidran during the lab session
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\screenshot-window-list\screenshot-window-list.exe
    sha256 9090ef8c3185081dc432e29ceb15758bf8cbde2c57b67fc4db4ccf226683e2bf
  • winpty.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\build\Release\winpty.dll
    sha256 fd764cdcb57aefd34525993df03eb83cc44f8764e4be815b0d379e12cd625789
  • winpty.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\prebuilds\win32-x64\winpty.dll
    sha256 e1cb26d868c954ba26817bedf3e4a5744e4ca2030adf51a7156e5ff2fadb881b
  • uninstall kimi code.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\Uninstall Kimi Code.exe
    sha256 d537b977d16988d5f4b8399e12d79551a20184d1636f9a71db86058bf681d856
  • elevate.exe
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\elevate.exe
    sha256 5bd1d98d4b0641aafe7fc28486fc589336ac5124d94d0c363e13fd29123651cc
  • conpty.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\conpty.dll
    sha256 7c7430632052ff703540b68371ec43821820aa1335d8e11dfbcd9ff00e9daaed
  • conpty.dll
    C:\Users\lab\AppData\Local\Programs\Kimi Code\resources\app.asar.unpacked\node_modules\node-pty\prebuilds\win32-x64\conpty\conpty.dll
    sha256 7c7430632052ff703540b68371ec43821820aa1335d8e11dfbcd9ff00e9daaed

What it talked to

Destinations

  • 127.0.0.1:62408asked by kimi code.exe14 connections
  • 103.143.17.156:443asked by kimi code.exe4 connections
  • 104.18.21.246:443asked by kimi code.exe
  • 104.26.9.108:443asked by kimi code.exe
  • 107.151.158.228:443asked by kimi code.exe

DNS

  • api.kimi.comasked by kimi code.exe
  • models.devasked by kimi code.exe
  • telemetry-logs.kimi.comasked by kimi code.exe