volt[.]exe | Triage™

Resubmissions

20/07/2026, 20:13

260720-yzn2qsfx2x10

20/07/2026, 19:57

260720-ypf85sft8v10

20/07/2026, 19:49

260720-yjtx2sdw6m8

20/07/2026, 19:43

260720-yfk6qse16x9

Sharing

Copy URL Twitter E-mail

General

Target
volt.exe
Size 11.8MB
Sample260720-ypf85sft8v
SHA256 4641277ea0c7047fd971e4756a33b1f6c11dc28e0c8c31cce37898aff98afa7f
MD5 9829d5aa8d7f82b653e94b07925e31d0
SHA1 d0ffada053af36f6503a7cebca9d33ea8cae5da6
SHA512 f169655ed97b816fd0d9a8adc006749979cfdfbbebaf88235654f3c6dc82246c8d7608483b0453aec5b64d72fa6ba7e5ac86d6702dd992e3c47e4bcc46a63d74
SSDEEP 196608:de3xsm3rlj7cJ9p3Q/fd0wAwUrehiQVU85jL49qwXNVRBxFR4/nJ:dueMrlsiGtwUihiMU85yVRiJ
TLSH
T13DC633AE1212751BE1809236C4404F2C1E2FF1E179E36ABC4F70A5F6F491AF9DE6B164
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
volt.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/lsp/lsp-ws-proxy.exe
unpack001/lsp/luau-lsp.exe
unpack001/tauri-app.exe

File Explorer

volt.exe

.exe 11.8MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 32KB
lsp/.luaurc

169B
lsp/en-us.json

6.8MB
lsp/globalTypes.d.lua

406KB
lsp/lsp-ws-proxy.exe

.exe 6.0MB
lsp/luau-en-us.json

155KB
lsp/luau-lsp.exe

.exe 10.7MB
tauri-app.exe

.exe 12.4MB

volt.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 4641277ea0c7047fd971e4756a33b1f6c11dc28e0c8c31cce37898aff98afa7f
MD5 9829d5aa8d7f82b653e94b07925e31d0
SHA1 d0ffada053af36f6503a7cebca9d33ea8cae5da6
SHA512 f169655ed97b816fd0d9a8adc006749979cfdfbbebaf88235654f3c6dc82246c8d7608483b0453aec5b64d72fa6ba7e5ac86d6702dd992e3c47e4bcc46a63d74
SSDEEP 196608:de3xsm3rlj7cJ9p3Q/fd0wAwUrehiQVU85jL49qwXNVRBxFR4/nJ:dueMrlsiGtwUihiMU85yVRiJ
TLSH
T13DC633AE1212751BE1809236C4404F2C1E2FF1E179E36ABC4F70A5F6F491AF9DE6B164
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

lsp/lsp-ws-proxy.exe

IMPHASH d5ce0dbeb73ce405aa2cf599126e1780
SHA256 486738c935d418254e43acdc8962f62cefcb97ee41c4586c070973ad23d3036e
MD5 7bc0212746818664f04a1f03c03fa3c5
SHA1 fbf39d56c8f005fab1cb77c97a0ef10948f46cb4
SHA512 aca3532bc6b7eaa9fd3aa60f4697ac74fbca35f8490b0529256165b3297cbb4221f2aeb5bb844334a6042e08312354516a5c0bc16de126a3553a8e9111f55be2
SSDEEP 49152:0qkaooYXxnagJe0/aqbE9d9YpPZtSFi1l4erIPXHsxgBYn7Ev+zVwAHhUG0IDj49:AdVJeP8y1HWeXt
TLSH
T1CD5605157B8E68AED169C8B4C34A4B621A3234DB1B36BAFF00C454353F6A7B45F2D349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4382220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\lsp-ws-proxy\lsp-ws-proxy\target\release\deps\lsp_ws_proxy.pdb

bcrypt

BCryptGenRandom

ntdll

RtlCaptureContext NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx RtlVirtualUnwind RtlLookupFunctionEntry

advapi32

SystemFunction036

kernel32

UnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetTimeZoneInformation SystemTimeToFileTime InitializeSListHead SetUnhandledExceptionFilter SetHandleInformation GetProcessHeap HeapAlloc HeapFree HeapReAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive SwitchToThread GetLastError GetSystemTimeAsFileTime DeleteFileW WriteFile CloseHandle RemoveDirectoryW MoveFileExW WakeAllConditionVariable AcquireSRWLockShared ReleaseSRWLockShared GetCommandLineW SetLastError GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW EnterCriticalSection LeaveCriticalSection TerminateProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetSystemInfo GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes ReadFile GetOverlappedResult PostQueuedCompletionStatus CancelIoEx GetFinalPathNameByHandleW TryAcquireSRWLockExclusive GetModuleHandleA GetProcAddress TlsGetValue TlsSetValue GetEnvironmentVariableW GetCurrentProcess GetCurrentThread ReleaseMutex GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA CreateMutexA GetStdHandle GetConsoleMode WriteConsoleW TlsAlloc GetModuleHandleW FormatMessageW CreateFileW GetFileInformationByHandle DeviceIoControl CreateDirectoryW InitializeCriticalSection GetCurrentProcessId CreateNamedPipeW DuplicateHandle ExitProcess TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency IsProcessorFeaturePresent WakeConditionVariable CreateThread SleepConditionVariableSRW WaitForSingleObject UnregisterWaitEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

ws2_32

WSACleanup WSASocketW bind WSAStartup recv send WSASend closesocket shutdown WSAIoctl setsockopt accept ioctlsocket WSAGetLastError getsockname listen

vcruntime140

__current_exception_context memcmp __current_exception __C_specific_handler _CxxThrowException memset memmove memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _get_initial_narrow_environment _configure_narrow_argv _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback exit _seh_filter_exe terminate _initialize_onexit_table _register_onexit_function _crt_atexit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

lsp/luau-lsp.exe

IMPHASH 132b364f5b030f001c9e42cb18876bf8
SHA256 dc79aa065f525bfcaff99dc7622049a5007f3a9113e9619decf326fe686ee14d
MD5 3e0d92b8a16f0aa05e23f0da47cf1893
SHA1 23a5d25688f57eda792639952061ef335980f904
SHA512 039a2156e0b8395dd3295aa1eb5fa5f5486c1c24d64f8c9459d6fe9383ee74964b3983d59e8d0b893f63afa0bc81610c1ea586932a39cfd7490ac3f3860b9318
SSDEEP 98304:8t4xopTQD4XTwPyyG1lCUgItYU9/mQW0DLGf:M4PMDwvF0/mQW0
TLSH
T123B66D3B229C11D8E0B7D07D8B8B9E93DBB2340903755AEF059045A65E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\luau-lsp\luau-lsp\build\RelWithDebInfo\luau-lsp.pdb

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW ReadProcessMemory GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetNamedPipeInfo FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx RtlUnwind SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo SetFileInformationByHandle GetTempPathW CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlUnwindEx TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

65KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

330KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tauri-app.exe

IMPHASH fe929d1b2c77445134eee659986acc90
SHA256 8db07e940c88f42e956e7b7ee93375be9b0eff51d542846b562b51c3f32d62ff
MD5 72197660042ea103b806d8a2fab6e10d
SHA1 89949bc55e1f2fdccf86990afcf021023e5b8622
SHA512 ccd2d5dfcee8a3aa7abae15fd74f6b6b4c2d41e7bb621c8bea2c6177d7cd79c090f32131d8fdc5aa653a65271739bab3b3cbff435e001a1043e97c26f3cc8fd2
SSDEEP 196608:0Wxw1GiFqcaiXJpchzvnOXltwLWAom9gtf6r9SIJ9:0aiXfcwXML3omKE8IJ
TLSH
T1A9D6AD03F29181E9C0ADC478835B9A37EB32BC8D4525B29F6BE45B212F26F506F1C759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5837060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tauri_app.pdb

kernel32

CreateWaitableTimerExW GetSystemInfo GetExitCodeProcess WaitForMultipleObjects DuplicateHandle CreateProcessW GetWindowsDirectoryW LocalFree GetSystemDirectoryW GetProcessTimes GlobalMemoryStatusEx CreateEventW OpenProcess TerminateProcess ExitProcess GetSystemTimePreciseAsFileTime CreateThread SetHandleInformation SleepEx CreateJobObjectW QueryInformationJobObject SetInformationJobObject AssignProcessToJobObject WaitForSingleObject ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId Sleep IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetProcAddress LoadLibraryExA TlsAlloc TlsGetValue TlsSetValue lstrlenW TlsFree EncodePointer IsDebuggerPresent RtlPcToFileHeader RaiseException GetCommandLineW UnhandledExceptionFilter SetEnvironmentVariableW SetUnhandledExceptionFilter InitializeSListHead RtlUnwindEx FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW GetLastError RtlVirtualUnwind RtlCaptureContext LoadLibraryA SetLastError AddVectoredExceptionHandler PostQueuedCompletionStatus LoadLibraryW RemoveDirectoryW FindNextFileW GetModuleHandleA SetFilePointerEx DeviceIoControl CreateSymbolicLinkW MoveFileExW GetModuleHandleW RtlLookupFunctionEntry WideCharToMultiByte MultiByteToWideChar FormatMessageW CompareStringOrdinal GetModuleFileNameW CopyFileExW DeleteFileW GetTempPathW GetFileAttributesW ReadFile GetOverlappedResult CancelIo CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW WriteFileEx ReadFileEx WriteConsoleW GetProcessHeap GetConsoleOutputCP SwitchToThread GetConsoleMode GetStdHandle CreatePipe SetFileCompletionNotificationModes HeapReAlloc GetCurrentThread CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetThreadStackGuarantee DeleteCriticalSection SetWaitableTimer CloseHandle FreeLibrary HeapAlloc GetUserDefaultUILanguage LCIDToLocaleName LoadLibraryExW OutputDebugStringW OutputDebugStringA HeapFree GetProcessId InitializeCriticalSectionAndSpinCount

advapi32

EventRegister SystemFunction036 RegQueryValueExW RegGetValueW EventUnregister RegOpenKeyExW RegCloseKey RegDeleteTreeW RegCreateKeyExW RegSetValueExW RegEnumValueW EventWriteTransfer EventSetInformation

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError NtWriteFile NtCancelIoFileEx NtDeviceIoControlFile NtReadFile NtOpenFile NtCreateFile RtlGetVersion NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

SetCapture CreatePopupMenu EnableMenuItem DrawMenuBar CheckMenuItem RedrawWindow MapVirtualKeyW MonitorFromPoint RegisterClassExW RegisterRawInputDevices ReleaseCapture GetKeyState GetAsyncKeyState EnumDisplayMonitors RemoveMenu GetKeyboardLayout MapVirtualKeyExW GetKeyboardState EnableWindow IsWindowEnabled TrackMouseEvent GetMonitorInfoW InvalidateRect InvalidateRgn ScreenToClient CreateMenu DestroyMenu CreateIcon SetMenu PostMessageW SystemParametersInfoA SendMessageW GetTouchInputInfo AppendMenuW ShowWindow PostQuitMessage InsertMenuW GetMenuBarInfo MonitorFromWindow GetClientRect GetWindowRect GetCursorPos SetForegroundWindow CreateAcceleratorTableW ClientToScreen SendInput DrawTextW FillRect GetWindowDC OffsetRect MapWindowPoints GetActiveWindow GetMenuItemInfoW DrawIconEx ReleaseDC GetDC SetMenuItemInfoW DestroyAcceleratorTable CloseTouchInputHandle MonitorFromRect UpdateWindow SetFocus GetRawInputData SetWindowRgn DestroyIcon TrackPopupMenu ValidateRect RegisterTouchWindow ChangeDisplaySettingsExW GetParent FindWindowExW TranslateAcceleratorW MsgWaitForMultipleObjectsEx GetMessageW GetWindow GetWindowThreadProcessId EnumWindows ToUnicodeEx EnumChildWindows DispatchMessageA GetMessageA AdjustWindowRect PostThreadMessageW DispatchMessageW TranslateMessage DestroyWindow SystemParametersInfoW FlashWindowEx LoadCursorW SetCursor IsIconic IsWindow CreateWindowExW SetCursorPos GetForegroundWindow SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW SetParent SetPropW SetWindowLongPtrW GetWindowLongPtrW ShowCursor ClipCursor GetSystemMetrics GetClipCursor DefWindowProcW SetWindowDisplayAffinity GetWindowPlacement SetWindowPlacement PeekMessageW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowPos SetWindowLongW GetSystemMenu RegisterWindowMessageA IsProcessDPIAware GetUpdateRect

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertFreeCertificateContext CryptUnprotectData CryptProtectData CertDuplicateCertificateContext CertDuplicateStore CertOpenStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertCloseStore CertGetCertificateChain

bcryptprimitives

ProcessPrng

psapi

GetProcessMemoryInfo

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

ole32

OleInitialize CoTaskMemAlloc RegisterDragDrop CoUninitialize CoCreateInstance RevokeDragDrop CoCreateFreeThreadedMarshaler CoInitialize CoInitializeEx CoTaskMemFree

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW ILFree ILCreateFromPathW SHOpenFolderAndSelectItems SHCreateItemFromParsingName DragQueryFileW DragFinish SHAppBarMessage

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc TaskDialogIndirect

gdi32

SetTextColor CreateDIBSection GetDeviceCaps SelectObject CreateCompatibleDC DeleteDC CreateRectRgn CreateSolidBrush SetBkMode CombineRgn BitBlt DeleteObject

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

ws2_32

WSADuplicateSocketW select shutdown socket recv WSARecv freeaddrinfo getaddrinfo send WSASend listen accept closesocket WSACleanup WSAStartup getsockname setsockopt bind connect ioctlsocket WSASocketW WSAIoctl WSAGetLastError getsockopt getpeername

secur32

QueryContextAttributesW FreeCredentialsHandle DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage AcquireCredentialsHandleA

api-ms-win-crt-math-l1-1-0

ceil floor __setusermatherr trunc pow round roundf

api-ms-win-crt-string-l1-1-0

wcscmp wcsncmp strlen strcmp _wcsicmp strcpy_s wcslen wcsncat

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

abort exit _initterm_e _initterm terminate _exit _configure_narrow_argv _crt_atexit _register_onexit_function _set_app_type _seh_filter_exe _initialize_onexit_table __p___argc _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

volt.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

lsp/.luaurc

lsp/en-us.json

lsp/globalTypes.d.lua

lsp/lsp-ws-proxy.exe

bcrypt

ntdll

advapi32

kernel32

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

lsp/luau-en-us.json

lsp/luau-lsp.exe

dbghelp

version

winhttp

advapi32

kernel32

shell32

generic

tauri-app.exe

kernel32

advapi32

bcrypt

ntdll

api-ms-win-core-synch-l1-2-0

user32