cognition.pbi.zip
- SHA256 52b29b43b364314968aaca8ef61f87e05d68bca81e3dfd445093c18cd6ea5ceb
Overview
overview
10Static
static
5AudioCapture.dll
windows10-2004-x64
3AudioCapture.dll
windows11-ltsc_2024-x64
3HTCTL32.dll
windows10-2004-x64
3HTCTL32.dll
windows11-ltsc_2024-x64
3PCICHEK.dll
windows10-2004-x64
3PCICHEK.dll
windows11-ltsc_2024-x64
3PCICL32.dll
windows10-2004-x64
3PCICL32.dll
windows11-ltsc_2024-x64
3Patch.html
windows10-2004-x64
3Patch.html
windows11-ltsc_2024-x64
3TCCTL32.dll
windows10-2004-x64
3TCCTL32.dll
windows11-ltsc_2024-x64
3complex.exe
windows10-2004-x64
10complex.exe
windows11-ltsc_2024-x64
10msvcr100.dll
windows10-2004-x64
3msvcr100.dll
windows11-ltsc_2024-x64
3pcicapi.dll
windows10-2004-x64
3pcicapi.dll
windows11-ltsc_2024-x64
3remcmdstub.exe
windows10-2004-x64
3remcmdstub.exe
windows11-ltsc_2024-x64
3Static task
static1
Behavioral task
behavioral1
Sample
AudioCapture.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
AudioCapture.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
HTCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
HTCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
PCICHEK.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
PCICHEK.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
PCICL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
PCICL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
Patch.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
Patch.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
TCCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
TCCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
complex.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
complex.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
msvcr100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
msvcr100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
pcicapi.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
pcicapi.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
remcmdstub.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
remcmdstub.exe
Resource
win11ltsc2024-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/msvcr100.dll |
| unpack001/msvcr100.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/AudioCapture.dll |
| unpack001/PCICL32.DLL |
| unpack001/TCCTL32.DLL |
| unpack001/msvcr100.dll |
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
count=18, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=36, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=7, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=23, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=1, productName=Unmarked objects,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=122, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
count=1, id=152, version=20115,
count=42, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=847, id=1, productName=Unmarked objects,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=254, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=211, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=24, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Jan 19, 2026
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Jan 19, 2026
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=5, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 11, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=3, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Feb 26, 2018
CN=CrossTec Corporation,O=CrossTec Corporation,L=Boca Raton,ST=Florida,C=US,1.2.840.113549.1.9.1=#0c196a6566664063726f7373746563736f6674776172652e636f6d
CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Feb 26, 2018
CN=CrossTec Corporation,O=CrossTec Corporation,L=Boca Raton,ST=Florida,C=US,1.2.840.113549.1.9.1=#0c196a6566664063726f7373746563736f6674776172652e636f6d
CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=86, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,