Run commands
The agent executes Shell commands and shows the real exit code.
Product
online malware analyzer for your own lab, running on your Windows PC
01
People who search for an "online malware analyzer" often expect a hosted service, but CogitoDesk is a desktop Windows app that runs on your own PC. It acts as your malware analyzer by running commands and reading files inside the isolated lab you control, and it helps you write a yara rule for malware analysis. It helps you understand threats on systems you own.
Read files
It reads scripts and shows diffs before you accept any changes in Ask first mode.
Write reports
The agent drafts analysis reports with IOCs for your own logs.
Features
- Filesread_file, write_file, edit_file, grep, and list_dir work in the chat folder.
- Shellruns terminal commands like certutil and reports the real exit code.
- Webuses web_search and http_get to read official documentation pages.
- Screenshots and imagesgen_image saves files and ocr reads text from screenshots.
- Orchestrationuses task for parallel work and run_on_model for hard steps.
- Approval modesAuto-run, Ask first, and Plan only control how actions happen.
- Cronruns prompts on a schedule.
- Modelssupports cloud API, local PC models, or the built-in model.
How it works
The agent runs tools inside your lab and shows every result as a card with the real output.
Compute the SHA-256 hash of the suspicious file in my working folder.
- Shell
certutil -hashfile sample.exe SHA256exit 0 - Shell
certutil -hashfile sample.exe SHA256hash ok - write_file
ioc_list.txtsaved - edit_file
ioc_list.txtdiff 1 - grep
SHA256 ioc_list.txt1 match
waiting for your OK before the next stepRejectAccept
Walkthroughs
Triage an attachment
You drop a suspicious email attachment into your isolated lab virtual machine and the agent uses Shell to compute the SHA-256 hash using certutil. It reads the file. The malware analyzer shows the text of a script using read_file. It then uses grep to find strings inside the file. The tool drafts a report with the hash and paths. You review the plan in Plan only or check the diff in Ask first. Every action appears in the chat as a card with its real result. This helps you be sure computer has no malware by verifying behavior.
Write a rule
You extract strings from a suspicious script in your lab and the agent uses read_file to see the code and understand the logic. It drafts rules. The agent uses edit_file to draft a YARA rule with meta and strings sections. It uses Shell to test the rule against known files. You review the diff in Ask first before accepting changes. This supports online malware analyzer creation for your own detections. A secure vm for malware analysis keeps samples isolated from threats. The agent writes the rule to a .yar file for reuse.
What CogitoDesk does not do
It is not a hosted service or plugin. It works only on your own files, PC and servers you are authorised to use. The reader keeps work to systems they own or are authorised to use. There is no guarantee that code, scans or analysis are correct, but it can help draft a YARA rule to detect a specific threat.
