Turn one suspicious Windows endpoint into evidence you can explain.

Yes. Malware INFO Help is currently available in 22 languages: Arabic, German, English, Spanish, French, Hindi, Indonesian, Italian, Japanese, Korean, Malay, Myanmar (Burmese), Dutch, Polish, Portuguese, Russian, Thai, Turkish, Ukrainian, Vietnamese, Chinese (Simplified), and Chinese (Traditional).

If I had to choose only two, I would name Live Protection and API Trace.

Live Protection helps analysts answer the first urgent incident question: what happened on this endpoint? It records current file, process, registry, network, ransomware, detection, and protection activity while the case is still fresh. That gives the analyst a fast timeline, affected paths, process IDs, actions, hashes, and related context instead of starting from memory or screenshots.

API Trace helps analysts answer the next question: what did the suspicious process actually do? Safe Trace gives low-impact correlated evidence, while Deep Trace can capture supported exact API boundaries, parameters, return values, behavior chains, memory snapshots, and a readable final report when the target and lab conditions are eligible. Together with Process Memory Capture and Payload & Memory Analyzer evidence, it shortens the path from 'this looks suspicious' to 'this is the behavior, this is the evidence, and this is the next safe action.'

No. Malware INFO is an investigation and incident-analysis companion, not a replacement for antivirus, Endpoint Security, EDR, XDR, SIEM, or their prevention and response controls. It is designed to examine artifacts and evidence that an existing endpoint platform did not expose clearly enough, helping the user investigate suspicious files, processes, persistence, memory, and related incident activity in greater detail. Its guided workflows are intended to help users with foundational cybersecurity knowledge make better-informed decisions, but results still depend on evidence quality and human judgment. The stronger the operator's cybersecurity knowledge and analytical discipline, the more effectively Malware INFO can be used. Keep existing endpoint protection enabled and follow your organization's response policy.

Smart App Control is a Windows 11 protection feature that uses Microsoft's cloud-powered app intelligence and code-integrity checks to decide whether an application is trusted to run. Malware INFO has not yet been signed with a trusted code-signing certificate, so Smart App Control may treat a new or reputation-unknown release as untrusted and display an alert or block it. This does not by itself prove that Malware INFO is malicious. Until signed releases are available, obtain Malware INFO only from its official release channel and verify the published version and SHA-256. Do not weaken an organization's security policy merely to run an unverified file. United Info-Sec is working toward trusted code signing for future Malware INFO releases.

Yes. Malware INFO has been tested successfully on 64-bit Windows 7 and can be used in legacy malware-sandbox and isolated lab workflows. On tested Windows 7 systems, it may temporarily use more memory during startup and can consume approximately 2 GB more RAM than on newer Windows versions before memory usage gradually settles. Because Windows 7 has reached end of life and Microsoft does not officially support .NET 10 on it, Malware INFO provides Windows 7 compatibility on a best-effort basis rather than the same support guarantee available on current Windows versions. Keep the Windows 7 environment isolated, provide sufficient RAM, take a snapshot before analysis, and do not use an end-of-life system as an ordinary Internet-connected endpoint.

The current Malware INFO application, installer, and Guard Service are distributed for x64 Windows; there is no x86 edition of the main application at this time. The packaged x86 API Trace worker exists only to inspect eligible 32-bit target processes and does not make the main product compatible with a 32-bit PC. Malware INFO is intended for incident investigation on both supported x64 Windows client systems and eligible x64 Windows Server versions. The interactive application requires a compatible graphical desktop environment, the required Windows components and services, administrative approval, and compliance with organizational policy; a Server Core installation without the required interactive desktop cannot host the current UI directly. Normal server workloads can be investigated, while Windows critical or protected processes remain intentionally unavailable for invasive tracing or dumping to protect system stability.