2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza
Size 710KB
Sample260713-kjmxvags2t
SHA256 13038bdaedb4782f32554ff1a577a56f09ef5c6564d71086f761e9d59778ef67
MD5 a6a7d9593bf91d990e809ceb6a78eac9
SHA1 7a9839364636a95aa11d5b9ef4751b91ab91d979
SHA512 e30d3fcc3645a2e7c984896399238d81b82c7982bb66ec8411de1b54bfd22149843f96959ee6c397341e94d1bee04ad1c05dffe4e5de42723630b5068666808c
SSDEEP 6144:/0xcAQyl5DuszObwdTvNjMsBUUlVYU2eRFP4IKT7Gv/7OD5x+Ab7doi7OG6+0eBe:EnjDT1rW+2eRYT7Gv/7ODBdovG2eBe
TLSH
T150F43203D76621D6F1BFC17E94C62722F9A17860073997D74610468A2B63FF8AB3E364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza

File Explorer

2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza

.exe 710KB

2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza

IMPHASH 87d8ab7f271f4f552c65885a87c9425a
SHA256 13038bdaedb4782f32554ff1a577a56f09ef5c6564d71086f761e9d59778ef67
MD5 a6a7d9593bf91d990e809ceb6a78eac9
SHA1 7a9839364636a95aa11d5b9ef4751b91ab91d979
SHA512 e30d3fcc3645a2e7c984896399238d81b82c7982bb66ec8411de1b54bfd22149843f96959ee6c397341e94d1bee04ad1c05dffe4e5de42723630b5068666808c
SSDEEP 6144:/0xcAQyl5DuszObwdTvNjMsBUUlVYU2eRFP4IKT7Gv/7OD5x+Ab7doi7OG6+0eBe:EnjDT1rW+2eRYT7Gv/7ODBdovG2eBe
TLSH
T150F43203D76621D6F1BFC17E94C62722F9A17860073997D74610468A2B63FF8AB3E364
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

37:4c:e0:0b:e4:5b:b0:6f:8a:b2:40:21:d6:01:b3:5e:7e:44:96:73

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HE 301668,CN=SPOTWARE SYSTEMS LTD,O=SPOTWARE SYSTEMS LTD,STREET=Spyrou Kyprianou\, 78\, MAGNUM BUSINESS CENTER\, Floor 3,L=Limassol,ST=Limassol,C=CY,1.2.840.113549.1.9.1=#0c1573657276696365734073706f74776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 7, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

33:41:5a:44:97:00:db:a2:9f:7a:23:f4

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 3, 2025 - Jul 1, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

556960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

algohost.exe.pdb

base

??0CheckOpResult@logging@@QEAA@PEBDPEAD1@Z ??0DictionaryValue@base@@QEAA@XZ ??0FilePath@base@@QEAA@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@1@@Z ??0JSONStringValueSerializer@@QEAA@PEAV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@Z ??0Lock@base@@QEAA@XZ ??0LogMessage@logging@@QEAA@PEBDHH@Z ??0PlatformSharedMemoryRegion@subtle@base@@QEAA@$$QEAV012@@Z ??0ScopedNativeLibrary@base@@QEAA@AEBVFilePath@1@@Z ??0ScopedProcessInformation@win@base@@QEAA@AEBU_PROCESS_INFORMATION@@@Z ??0ScopedProcessInformation@win@base@@QEAA@XZ ??0StartupInformation@win@base@@QEAA@XZ ??0UnsafeSharedMemoryRegion@base@@QEAA@XZ ??0Value@base@@QEAA@$$QEAV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@Z ??0Value@base@@QEAA@W4Type@01@@Z ??1CheckError@logging@@QEAA@XZ ??1FilePath@base@@QEAA@XZ ??1JSONStringValueSerializer@@UEAA@XZ ??1Lock@base@@QEAA@XZ ??1LogMessage@logging@@UEAA@XZ ??1PlatformSharedMemoryRegion@subtle@base@@QEAA@XZ ??1RefCountedThreadSafeBase@subtle@base@@IEAA@XZ ??1ScopedNativeLibrary@base@@UEAA@XZ ??1ScopedProcessInformation@win@base@@QEAA@XZ ??1SharedMemoryMapping@base@@UEAA@XZ ??1StartupInformation@win@base@@QEAA@XZ ??1UnsafeSharedMemoryRegion@base@@QEAA@XZ ??1Value@base@@QEAA@XZ ??4FilePath@base@@QEAAAEAV01@$$QEAV01@@Z ??6std@@YAAEAV?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@0@AEAV120@PEB_W@Z ?Append@FilePath@base@@QEBA?AV12@AEBV12@@Z ?Append@Value@base@@QEAAXN@Z ?Append@Value@base@@QEAAXV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@@Z ?AssertAcquired@Lock@base@@QEBAXXZ ?BaseInitLoggingImpl_built_without_NDEBUG@logging@@YA_NAEBULoggingSettings@1@@Z ?BaseName@FilePath@base@@QEBA?AV12@XZ ?Check@CheckError@logging@@SA?AV12@PEBDH0@Z ?CheckHeldAndUnmark@Lock@base@@AEAAXXZ ?CheckOp@CheckError@logging@@SA?AV12@PEBDHPEAVCheckOpResult@2@@Z ?CheckOpValueStr@logging@@YAPEADK@Z ?CheckOpValueStr@logging@@YAPEAD_K@Z ?CheckUnheldAndMark@Lock@base@@AEAAXXZ ?CloseHandle@HandleTraits@win@base@@SA_NPEAX@Z ?Create@UnguessableToken@base@@SA?AV12@XZ ?DCheck@CheckError@logging@@SA?AV12@PEBDH0@Z ?DCheckOp@CheckError@logging@@SA?AV12@PEBDHPEAVCheckOpResult@2@@Z ?Deserialize@UnsafeSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?DirName@FilePath@base@@QEBA?AV12@XZ ?DuplicateFrom@ScopedProcessInformation@win@base@@QEAA_NAEBV123@@Z ?FindBoolKey@Value@base@@QEBA?AV?$Optional@_N@2@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@@Z ?FindKey@Value@base@@QEBAPEBV12@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@@Z ?FindStringKey@Value@base@@QEBAPEBV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@@Z ?GetFunctionPointer@ScopedNativeLibrary@base@@QEBAPEAXPEBD@Z ?GetList@Value@base@@QEBA?AV?$CheckedContiguousRange@$$CBV?$vector@VValue@base@@V?$allocator@VValue@base@@@__1@std@@@__1@std@@@2@XZ ?GetProgramCounter@base@@YAPEBXXZ ?GetString@Value@base@@QEBAAEBV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@XZ ?GetVersion@win@base@@YA?AW4Version@12@XZ ?GetWindowObjectName@win@base@@YA?AV?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@PEAX@Z ?InitializeProcThreadAttributeList@StartupInformation@win@base@@QEAA_NK@Z ?IsValid@ScopedProcessInformation@win@base@@QEBA_NXZ ?IsValid@UnsafeSharedMemoryRegion@base@@QEBA_NXZ ?LockInternalWithTracking@LockImpl@internal@base@@AEAAXXZ ?Map@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?PCheck@CheckError@logging@@SA?AV12@PEBDH0@Z ?RandBytes@base@@YAXPEAX_K@Z ?Read@JSONReader@base@@SA?AV?$Optional@VValue@base@@@2@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@H_K@Z ?Serialize@JSONStringValueSerializer@@UEAA_NAEBVValue@base@@@Z ?Set@ScopedProcessInformation@win@base@@QEAAXAEBU_PROCESS_INFORMATION@@@Z ?SetInteger@DictionaryValue@base@@QEAAPEAVValue@2@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@H@Z ?SetKey@Value@base@@QEAAPEAV12@$$QEAV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@$$QEAV12@@Z ?SetKey@Value@base@@QEAAPEAV12@PEBD$$QEAV12@@Z ?SetName@PlatformThread@base@@SAXAEBV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@Z ?SetString@DictionaryValue@base@@QEAAPEAVValue@2@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@AEBV?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@Z ?SetStringKey@Value@base@@QEAAPEAV12@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@2@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@2@@Z ?ShouldCreateLogMessage@logging@@YA_NH@Z ?SplitStringPiece@base@@YA?AV?$vector@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@base@@V?$allocator@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@base@@@__1@std@@@__1@std@@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@1@0W4WhitespaceHandling@1@W4SplitResult@1@@Z ?StreamValToStr@logging@@YAPEADPEBXP6AXAEAV?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@0@Z@Z ?StringPrintf@base@@YA?AV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@PEBDZZ ?StringPrintf@base@@YA?AV?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@PEB_WZZ ?Take@PlatformSharedMemoryRegion@subtle@base@@SA?AV123@V?$GenericScopedHandle@VHandleTraits@win@base@@VDummyVerifierTraits@23@@win@3@W4Mode@123@_KAEBVUnguessableToken@3@@Z ?Take@ScopedProcessInformation@win@base@@QEAA?AU_PROCESS_INFORMATION@@XZ ?TakeThreadHandle@ScopedProcessInformation@win@base@@QEAAPEAXXZ ?UTF16ToUTF8@base@@YA_NPEB_W_KPEAV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@@Z ?UTF8ToUTF16@base@@YA_NPEBD_KPEAV?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@@Z ?UpdateProcThreadAttribute@StartupInformation@win@base@@QEAA_N_KPEAX0@Z ?Write@JSONWriter@base@@SA_NAEBVValue@2@PEAV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@_K@Z ?stream@CheckError@logging@@QEAAAEAV?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@XZ g_target_id

libc++

??0?$__vector_base_common@$00@__1@std@@IEAA@XZ ??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA@$$QEAV012@@Z ??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA@AEBV012@@Z ??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA@XZ ??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA@_KD@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@$$QEAV012@@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@AEBV012@@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@AEBV012@_K1AEBV?$allocator@_W@12@@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@AEBV?$allocator@_W@12@@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@PEB_W_K@Z ??0?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@XZ ??1?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA@XZ ??1?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA@XZ ??1locale@__1@std@@QEAA@XZ ??4?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAAEAV012@AEBV012@@Z ??4?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAAEAV012@PEBD@Z ??4?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@$$QEAV012@@Z ??4?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@AEBV012@@Z ??4?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@PEB_W@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@H@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@I@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@J@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@K@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@P6AAEAV012@AEAV012@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@_K@Z ??6?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV012@_N@Z ??A?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEA_W_K@Z ??A?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAAEB_W_K@Z ??B?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBA_NXZ ??Y?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAAEAV012@AEBV012@@Z ??Y?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAAEAV012@PEBD@Z ??Y?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@AEBV012@@Z ??Y?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@PEB_W@Z ??Y?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV012@_W@Z ?__alloc@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAAEAV?$allocator@D@23@XZ ?__alloc@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAAEAV?$allocator@_W@23@XZ ?__get_short_pointer@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAPEADXZ ?__get_short_pointer@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAPEA_WXZ ?__init@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAXPEBD_K@Z ?__init@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAXPEB_W_K1@Z ?__init@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAXPEB_W_K@Z ?__recommend@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@CA_K_K@Z ?__recommend@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@CA_K_K@Z ?__set_long_cap@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAX_K@Z ?__set_long_cap@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAX_K@Z ?__set_long_pointer@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAXPEAD@Z ?__set_long_pointer@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAXPEA_W@Z ?__set_long_size@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAX_K@Z ?__set_long_size@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAX_K@Z ?__set_short_size@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AEAAX_K@Z ?__set_short_size@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@AEAAX_K@Z ?__throw_length_error@?$__basic_string_common@$00@__1@std@@IEBAXXZ ?__throw_length_error@?$__vector_base_common@$00@__1@std@@IEBAXXZ ?append@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAAEAV123@PEBD@Z ?append@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@AEBV123@@Z ?append@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@PEB_W@Z ?append@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@PEB_W_K@Z ?assign@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@PEB_W_K@Z ?back@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEA_WXZ ?begin@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA?AV?$__wrap_iter@PEAD@23@XZ ?begin@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA?AV?$__wrap_iter@PEA_W@23@XZ ?begin@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA?AV?$__wrap_iter@PEB_W@23@XZ ?c_str@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBAPEBDXZ ?c_str@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAPEB_WXZ ?cerr@__1@std@@3V?$basic_ostream@DU?$char_traits@D@__1@std@@@12@A ?cin@__1@std@@3V?$basic_istream@DU?$char_traits@D@__1@std@@@12@A ?clear@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAXXZ ?clear@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAXXZ ?compare@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBAHAEBV123@@Z ?compare@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBAH_K0PEBD0@Z ?compare@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAHAEBV123@@Z ?compare@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAH_K0PEB_W0@Z ?compare@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAH_K0PEB_W@Z ?copy@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBA_KPEAD_K1@Z ?copy@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_KPEA_W_K1@Z ?data@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBAPEBDXZ ?data@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBAPEB_WXZ ?empty@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBA_NXZ ?empty@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_NXZ ?end@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAA?AV?$__wrap_iter@PEAD@23@XZ ?end@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAA?AV?$__wrap_iter@PEA_W@23@XZ ?end@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA?AV?$__wrap_iter@PEB_W@23@XZ ?erase@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@_K0@Z ?fill@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBADXZ ?find@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_KPEB_W_K@Z ?find@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_K_W_K@Z ?find_first_of@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_K_W_K@Z ?flags@ios_base@__1@std@@QEBAIXZ ?flush@?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV123@XZ ?get_allocator@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA?AV?$allocator@_W@23@XZ ?getloc@ios_base@__1@std@@QEBA?AVlocale@23@XZ ?good@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBA_NXZ ?id@?$ctype@D@__1@std@@2V0locale@23@A ?insert@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@_KAEBV123@@Z ?insert@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@_KPEB_W@Z ?length@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_KXZ ?max_size@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBA_KXZ ?max_size@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_KXZ ?pubsync@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QEAAHXZ ?push_back@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEAAXD@Z ?put@?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QEAAAEAV123@D@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@__1@std@@@23@XZ ?replace@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAAEAV123@_K0PEB_W@Z ?resize@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEAAX_K@Z ?rfind@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_K_W_K@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEAAXI@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QEAAHXZ ?size@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QEBA_KXZ ?size@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA_KXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QEAA_JPEBD_J@Z ?substr@?$basic_string@_WU?$char_traits@_W@__1@std@@V?$allocator@_W@23@@__1@std@@QEBA?AV123@_K0@Z ?sync_with_stdio@ios_base@__1@std@@SA_N_N@Z ?tie@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@__1@std@@@23@XZ ?uncaught_exception@std@@YA_NXZ ?use_facet@locale@__1@std@@AEBAPEBVfacet@123@AEAVid@123@@Z ?widen@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QEBADD@Z ?width@ios_base@__1@std@@QEAA_J_J@Z ?width@ios_base@__1@std@@QEBA_JXZ

shell32

CommandLineToArgvW

kernel32

AssignProcessToJobObject CloseHandle CompareStringEx CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DuplicateHandle EnterCriticalSection EnumSystemLocalesEx FormatMessageW FreeLibrary GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHandleCount GetProcessHeaps GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName HeapDestroy HeapSetInformation InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile PostQueuedCompletionStatus ProcessIdToSessionId QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter RaiseException ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SearchPathW SetEnvironmentVariableW SetEvent SetHandleInformation SetInformationJobObject SetLastError SetThreadAffinityMask SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory lstrcmpiA lstrlenW

advapi32

AccessCheck ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowStationW GetProcessWindowStation GetThreadDesktop SetProcessWindowStation UserHandleGrantAccess

ole32

CoTaskMemFree

vcruntime140d

_CxxThrowException __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_type_info_destroy_list _purecall memcmp memcpy memmove memset

ucrtbased

_CrtDbgReportW __acrt_iob_func __p___argc __p___wargv __p__commode __setusermatherr __stdio_common_vsnwprintf_s _c_exit _callnewh _cexit _configthreadlocale _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _execute_onexit_table _exit _fileno _free_dbg _get_initial_wide_environment _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _localtime64_s _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_dll _seh_filter_exe _set_app_type _set_fmode _set_new_mode _setmode _strnicmp _time64 _wassert _wcsdup _wcsicmp _wcsnicmp abort exit free freopen malloc strcpy strlen terminate wcscmp wcsftime wcslen

Name

.text

Size

548KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

46B

Characteristics

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_a6a7d9593bf91d990e809ceb6a78eac9_cobalt-strike_mespinoza

base

libc++

shell32

kernel32

advapi32

user32

ole32

vcruntime140d

ucrtbased

generic