Frequently asked questions and safe-lab guidance.

Yes. Malware INFO Help is currently available in 22 languages: Arabic, German, English, Spanish, French, Hindi, Indonesian, Italian, Japanese, Korean, Malay, Myanmar (Burmese), Dutch, Polish, Portuguese, Russian, Thai, Turkish, Ukrainian, Vietnamese, Chinese (Simplified), and Chinese (Traditional).

If I had to choose only two, I would name Live Protection and API Trace.

Live Protection helps analysts answer the first urgent incident question: what happened on this endpoint? It records current file, process, registry, network, ransomware, detection, and protection activity while the case is still fresh. That gives the analyst a fast timeline, affected paths, process IDs, actions, hashes, and related context instead of starting from memory or screenshots.

API Trace helps analysts answer the next question: what did the suspicious process actually do? Safe Trace gives low-impact correlated evidence, while Deep Trace can capture supported exact API boundaries, parameters, return values, behavior chains, memory snapshots, and a readable final report when the target and lab conditions are eligible. Together with Process Memory Capture and Payload & Memory Analyzer evidence, it shortens the path from 'this looks suspicious' to 'this is the behavior, this is the evidence, and this is the next safe action.'

No. Malware INFO is an investigation and incident-analysis companion, not a replacement for antivirus, Endpoint Security, EDR, XDR, SIEM, or their prevention and response controls. It is designed to examine artifacts and evidence that an existing endpoint platform did not expose clearly enough, helping the user investigate suspicious files, processes, persistence, memory, and related incident activity in greater detail. Its guided workflows are intended to help users with foundational cybersecurity knowledge make better-informed decisions, but results still depend on evidence quality and human judgment. The stronger the operator's cybersecurity knowledge and analytical discipline, the more effectively Malware INFO can be used. Keep existing endpoint protection enabled and follow your organization's response policy.

Smart App Control is a Windows 11 protection feature that uses Microsoft's cloud-powered app intelligence and code-integrity checks to decide whether an application is trusted to run. Malware INFO has not yet been signed with a trusted code-signing certificate, so Smart App Control may treat a new or reputation-unknown release as untrusted and display an alert or block it. This does not by itself prove that Malware INFO is malicious. Until signed releases are available, obtain Malware INFO only from its official release channel and verify the published version and SHA-256. Do not weaken an organization's security policy merely to run an unverified file. United Info-Sec is working toward trusted code signing for future Malware INFO releases.

Yes. Malware INFO has been tested successfully on 64-bit Windows 7 and can be used in legacy malware-sandbox and isolated lab workflows. On tested Windows 7 systems, it may temporarily use more memory during startup and can consume approximately 2 GB more RAM than on newer Windows versions before memory usage gradually settles. Because Windows 7 has reached end of life and Microsoft does not officially support .NET 10 on it, Malware INFO provides Windows 7 compatibility on a best-effort basis rather than the same support guarantee available on current Windows versions. Keep the Windows 7 environment isolated, provide sufficient RAM, take a snapshot before analysis, and do not use an end-of-life system as an ordinary Internet-connected endpoint.

The current Malware INFO application, installer, and Guard Service are distributed for x64 Windows; there is no x86 edition of the main application at this time. The packaged x86 API Trace worker exists only to inspect eligible 32-bit target processes and does not make the main product compatible with a 32-bit PC. Malware INFO is intended for incident investigation on both supported x64 Windows client systems and eligible x64 Windows Server versions. The interactive application requires a compatible graphical desktop environment, the required Windows components and services, administrative approval, and compliance with organizational policy; a Server Core installation without the required interactive desktop cannot host the current UI directly. Normal server workloads can be investigated, while Windows critical or protected processes remain intentionally unavailable for invasive tracing or dumping to protect system stability.

Automated online checkout is not connected yet. Professional and Enterprise purchases are currently handled through confirmed Crypto (USDT) or PayPal payment instructions. Select Purchase and contact [email protected] with the edition, device count, and license term. Send funds only using payment details confirmed through that official address; Malware INFO does not request a wallet seed phrase, private key, or account password.

A Temp Key represents the purchased entitlement; it is not yet the device-specific license used by Malware INFO.

1. Open the Malware INFO User Portal at https://portal.malwareinfo.app/.
2. Sign in with the exact email address used to purchase the key or the customer email address assigned to the key by the approved reseller.
3. Activate or redeem the purchased Temp Key. The Portal will display the license edition and the number of included devices. A different Portal email account cannot redeem that email-bound key.
4. Install Malware INFO only from the official release channel approved for your account or organization.
5. Open Malware INFO and select Register.
6. Copy the Machine Hash shown by the application.
7. Return to the Portal, add the Machine Hash to an available device slot, and generate the device license key.
8. Enter that device license key in Malware INFO and activate the application.
9. Malware INFO will restart automatically after successful activation.
10. After restart, confirm that Live Protection is running. If it does not start automatically, open Protection Matrix from the sidebar and select Start protection service. Keep the Temp Key, Machine Hash, and device license key private. Use only portal.malwareinfo.app and official Malware INFO installers.

No. The purchased license term is not counted from the purchase date. It begins when you first register a Machine Hash in the Portal to generate the device license. You may therefore purchase the entitlement in advance, but add the Machine Hash and generate the device license only when you are ready to deploy Malware INFO on that computer. Once activation has begun, the applicable one-year, two-year, or other purchased term runs according to the entitlement shown in the Portal.

Some important workflows and practical usage details are explained inside the application through the Help content attached to each sidebar area. The public website and Free presentation focus on the essential information visitors should understand first, so they do not reproduce every operational workflow or advanced use case. To see the features more clearly in practice, follow the Malware INFO Blog and official Malware INFO YouTube demonstrations as they are published.

Personal is limited to one device for one, two, or three years. Organization offers 3, 10, 50, 100, or above 200 devices. Reseller offers 10, 50, 100, or above 200 independent customer licenses. Above 200 is always handled as a custom quote.

The Organization and Reseller 10-device totals are intentionally identical. The published Reseller totals are lower than Organization at 50 and 100 devices for the same edition and term. For above-200 custom quotes, the matching Reseller quote must also remain lower.

No. A reseller must use a reseller-only Portal email account. If an email account has already redeemed a customer entitlement, registered a Machine Hash, or generated a device license, that account cannot later be approved as a reseller. This prevents customer device ownership and reseller inventory from mixing in one account. If you want to become a reseller, sign in to the Portal once with a separate reseller email address and ask Malware INFO Admin to approve that reseller-only account before reseller inventory is issued.

No. An activated device license is bound to the registered Machine Hash and cannot normally be reused to activate Malware INFO on another computer. The license will not be revoked solely because another person copied or viewed that device-bound key. Keep the key private, do not publish it, and contact Malware INFO support if the Portal shows an unknown device or other unauthorized account activity.

A license confirmed to be distributed publicly with Malware INFO, used for unauthorized redistribution, or shared to bypass the licensed device and account rules will be added to the revocation list. The revoked key can no longer be used for continued licensed operation. A user who wants to continue using Malware INFO must purchase a new legitimate license. Accidental exposure of a device-bound key is reviewed separately from confirmed public software-and-license distribution.

A Redeem Key is bound to the email address recorded when the key is purchased or assigned by an approved reseller. Sign out of the Portal, then sign in with that exact purchase email address and redeem the key from that account. The Portal will show the key as invalid when it is entered from a different email account, even if the key text itself was copied correctly. If the key is still rejected from the correct purchase email, contact the seller or Malware INFO support from that same email address and provide the order or proof of purchase. Keep the key private and never send an account password.

Do not execute an unknown file on an everyday computer.

1. Preserve its original path, name, size, and SHA-256.
2. Use Lookup when policy permits sharing the indicator.
3. Run Basic and Deep Signature Scan for local hash, HEX, and YARA evidence.
4. Use Zero-Day Analysis and Guard history for behavior context.
5. Escalate to a controlled lab only when live execution is authorized and necessary.

No. AlertOnly means a finding needs review but has no response authority. For Rapid Scan and Deep Signature Scan, even a score-100 or exact MD5/SHA-1/SHA-256/HEX/YARA match remains Alert Only: the grid cannot terminate, quarantine, blacklist, whitelist/add an exception, block, delete, or change policy. Read the engine, matched value, provenance, process identity, signer, path, coverage, operation state, and related events, then preserve or export the evidence for a separately authorized workflow.

First read the detection source and response ceiling. Current legacy Manual/Rapid hash and Deep Signature HEX/YARA findings are Alert Only even when the match is exact or the score is 100. Their result grids provide View Details, copy/export, approved reputation lookup, and evidence inspection; they do not expose process termination, quarantine, delete, blacklist, whitelist/exception, IP block, or policy mutation. Direct handler invocation returns a typed refusal before any mutation sink or Guard request.

A Zero-Day Analysis or package score is also triage evidence, not response authority. A legacy hash/HEX/YARA package child remains Alert Only, cannot create Confirmed, and cannot make a high-score package appear as green Success. Preserve reports and provenance, correlate them with Deep API Trace behavior, Payload & Memory Analyzer strings/memory evidence, signer/path context, and separately governed Guard evidence. If harmful activity is continuing, isolate the affected computer through the approved incident-response process; that operational decision is separate from declaring the file confirmed malware or granting this legacy grid mutation authority.

Observed means activity was recorded without a malicious verdict. Allowed means the current policy did not block that event; it does not certify the program as safe. AlertOnly means review is required but automatic containment was not justified. Detected means a configured confirmed-detection source matched. Quarantined means a supported file was moved into protected containment. Always read Source, Engine, Reason, Action/Decision, path, and correlation together.

Treat the alert as unverified until the exact file is checked. Record the AV detection name, file path, product version, and SHA-256. Confirm that the package came from the approved Malware INFO distribution channel; compare a published hash when one is available; inspect the publisher signature when the release provides one; update the AV engine and security intelligence; and submit the exact file to the AV vendor as a suspected false positive. Microsoft Defender submissions can be made through https://www.microsoft.com/wdsi/filesubmission. If source, hash, or release identity cannot be verified, do not restore or exclude the file.

On a normal production or personal endpoint, neither should be excluded by default. If a verified Malware INFO component is falsely detected and an immediate, policy-approved workaround is essential, allow only the exact verified product file reported by the AV. A malware sample or recovered payload should remain scanned on ordinary endpoints. Live-malware exclusions belong only inside a disposable, isolated research guest and only for the shortest necessary test window.

Not necessarily. A payload dump, memory image, quarantine object, or API evidence artifact can contain the real malicious bytes recovered from the target. An AV detection on that evidence may therefore be correct even when Malware INFO itself is clean. Record the exact detected path and hash, keep it inside controlled case storage, and do not classify it as a product false positive merely because Malware INFO created the file.

Prefer the exact verified file named in the alert, not a folder. Expected examples are C:\Program Files\MalwareInfo\MalwareInfo.exe, C:\Program Files\MalwareInfo\GuardService\MalwareInfo.GuardService.exe, and—only when Deep Trace requires them—the matching worker under GuardService\Workers\x86 or GuardService\Workers\x64. Allow only the component that was verified and blocked. Recheck its identity after every installer upgrade because the file hash changes. If exact-file allowlisting is unavailable, an administrator must document and approve any broader temporary rule; the entire installation folder is not the default recommendation.

A Microsoft Defender process exclusion can stop real-time scanning of files opened by that process, wherever those files are located. Malware INFO intentionally opens suspicious files, dumps, rules, and evidence, so a process exclusion can create a much wider blind spot than an exact product-file exception. Use an exact verified file allow decision when unavoidable; do not exclude MalwareInfo.exe, the Guard Service, or API Trace workers as processes that may open arbitrary content.

Never exclude C:\, an entire drive, C:\Windows, C:\ProgramData, C:\Users, a whole user profile, Downloads, Desktop, %TEMP%, %APPDATA%, or the complete C:\ProgramData\MalwareInfo\SecurityState tree. Do not use wildcard or extension-wide exclusions for .exe, .dll, .bin, .dat, or .memimg. These locations and types are common malware staging areas, so a broad rule would hide unrelated threats.

Use two separate passes. Pass 1—protection-on: keep the AV enabled, record its detection and timing, preserve Guard/AV evidence, and complete all static analysis possible. Pass 2—controlled execution: only when authorized behavior evidence is still required, revert a disposable analysis VM to a clean snapshot, disconnect it from production networks, disable host integration, place the sample in a dedicated guest-only lab folder, and apply the narrowest temporary guest exclusion only if the AV still prevents the approved test. Start Malware INFO monitoring before launch, stop collection after the planned window, preserve checksums and reports, then revert or destroy the guest.

1. Use a disposable full VM or an organization-approved sandbox; a full VM is preferable when Guard Service installation, restart, command-line replay, or longer observation is required.
2. Take a clean snapshot before importing the sample.
3. Remove corporate accounts, browser sessions, tokens, VPNs, SSH keys, password managers, and real documents.
4. Disable shared clipboard, drag-and-drop, shared folders, host-drive mapping, USB passthrough, and unnecessary guest integrations.
5. Use no network or a controlled malware-lab network with no route to production.
6. Prepare monitoring and evidence storage before launch.
7. Revert or destroy the guest after collection.

Do not execute the sample. Limit the case to static hash, signature, YARA, PE, strings, HEX, reputation, existing Guard history, and already-collected evidence. Preserve the artifact according to policy and transfer the case to an authorized team or lab. Lack of a lab is not a reason to disable AV or create sample exclusions on a production computer.

Inside the disposable guest only, create a dedicated path such as C:\MalwareLab\Samples for authorized test inputs and exclude only that folder for the test window. If the AV removes recovered bytes before analysis, the only product evidence leaves that may need the same guest-only treatment are C:\ProgramData\MalwareInfo\SecurityState\Guard\PayloadEvidence and C:\ProgramData\MalwareInfo\SecurityState\Guard\ApiTraceEvidence. Do not exclude their parent Guard or SecurityState folders. Record who added the rule, why, when it expires, and remove it before the guest is connected anywhere or reused.

Not on the host or an ordinary endpoint. Full AV disablement removes unrelated protection and makes operator mistakes harder to contain. In an approved disposable guest, a tightly controlled team may temporarily change protection only when the research objective cannot be met with a narrow path/file rule, but that is an exceptional laboratory decision requiring authorization, isolation, a fixed time window, and mandatory snapshot reversion—not normal Malware INFO setup guidance.

Default to no network. If network behavior must be observed, use a controlled lab segment or simulation service with no route to production, management interfaces, shared storage, printers, identity services, or the host. Capture DNS and connection evidence, apply egress limits, and obtain authorization before allowing any external communication. Do not let a sample contact real victims, scan third parties, send spam, or exfiltrate captured data.

Stop the API/Payload session, export the human-readable report and checksum inventory through the approved evidence workflow, record the sample and report hashes, and close the test. Do not return the guest to normal use. Revert to the clean snapshot or destroy the VM. Remove any temporary AV rule from the reusable base image and verify that no shared folder, clipboard, mounted image, or removable media still exposes sample bytes.

No. Malware INFO observes, scans, correlates, dumps, and helps contain supported activity, but it is not a virtualization boundary and cannot guarantee interception of every exploit, kernel driver, direct syscall, credential theft, network action, destructive operation, or anti-analysis technique. Unknown code must still be treated as hostile and executed only inside an authorized isolated environment.

Safe Trace is the least-invasive selected-process timeline: it correlates available Guard, Event Log, ETW, runtime, and snapshot evidence without attaching a debugger or injecting into the target. Deep Trace is an explicit matching-bitness debugger workflow that can capture supported API entry/return evidence and bounded parameters, but it changes timing, may trigger anti-debug behavior, has target eligibility limits, and is never automatic. Use Safe first; choose Deep only when exact supported API calls are required and the lab accepts the added impact.

Snapshot capture and exact API collection are independent. Exact rows can be absent because Deep Trace was not requested, the worker failed integrity or architecture checks, attachment started after the loader/decrypt sequence, execution moved to another PID, the sample used an unsupported wrapper, custom crypto, manual mapping, or direct syscalls, or the monitored API was simply not called during the observation window. Open index.html first and read Collection Verdict, Trace Mode, Worker state, timing, source gaps, child PID clues, and diagnostics before concluding that the behavior did not occur.

New API Trace memory artifacts use compact mem_p<PID>_<attempt>_<sequence>_<base>_<kind> filenames so report tables and Windows paths remain usable. The full session, process creation time, executable identity, memory range, capture kind, and SHA-256 remain in the snapshot manifest and checksum inventory. A compact filename or PID alone is not evidence identity. Historical long filenames remain accepted and are not renamed because renaming would invalidate their manifest and checksum bindings.

No. A dump proves that bytes were readable from a selected memory region at a recorded time. JIT runtimes, browsers, compatibility layers, security tools, and packers can also create executable private memory. Correlate the region with its MZ/PE identity, entropy, strings, protection transitions, writer/thread origin, API timeline, process path, signer, network/file/persistence activity, and the Payload & Memory Analyzer report before assigning a malware conclusion.

payload_<pid>_<address>_*.bin is created by the analyst-requested Dump Selected action. payload_auto_<pid>_<address>_*.bin is created by an eligible automatic monitoring or memory-telemetry capture. The prefix identifies how capture was requested; it does not identify a malware family or confidence level. Read the matching sidecar/session metadata for PID, address, size, protection, reason, time, and hash.

Not reliably from one memory chunk. The current analyzer performs bounded static PE/raw-memory inspection, strings and HEX preview, and matching session JSON/JSONL correlation. It can describe architecture, artifact shape, capabilities, and behavior leads, but those are analyst hypotheses rather than a guaranteed family attribution.

Every Process Memory Capture primary artifact is capped at exactly 1 GiB (1,073,741,824 bytes). The limit bounds disk use, capture time, and analyzer memory. Windows MiniDump, Full User-Mode Dump, Individual Memory Region Dump, and PE Image Dump publish only when complete. Raw Process Memory Image and MalwareInfo Custom Memory Format may preserve explicitly labelled Partial evidence. Oversized or incomplete evidence is not automatically benign or malicious.

Process Memory Capture offers six analyst-selected formats from a process row's Capture Process Memory menu.

1. Windows MiniDump preserves debugger-friendly process state for WinDbg and compatible tools; use it for a compact first-pass investigation.
2. Full User-Mode Dump asks Windows MiniDumpWriteDump for the broadest supported user-mode state; use it when stacks, modules, handles, and readable memory must stay together in one debugger-oriented artifact.
3. Raw Process Memory Image preserves readable virtual-memory bytes together with exact address gaps; use it for byte-level review, strings, carving, and address-aware reconstruction.
4. Individual Memory Region Dump saves one analyst-selected readable region; use it when a specific RX/RWX allocation or suspicious range is the evidence target.
5. PE Image Dump reconstructs one eligible in-memory PE image; use it when an MZ/PE module or injected image must be inspected as a PE-shaped artifact.
6. MalwareInfo Custom Memory Format stores bounded process-memory evidence and typed provenance in MalwareInfo's structured format; use it for MalwareInfo analysis and evidence handoff. Every primary artifact is capped at exactly 1 GiB (1,073,741,824 bytes). Windows MiniDump, Full User-Mode Dump, Individual Memory Region Dump, and PE Image Dump publish only when Complete. Only Raw Process Memory Image and MalwareInfo Custom Memory Format may publish Partial evidence, and every missing range or failure remains explicit. A capture is point-in-time evidence, not continuous behavior history and not proof of which API allocated, decrypted, wrote, or executed the bytes. The system permits one capture at a time and has no queue. The dedicated x86 and x64 Memory Capture Hosts support matching-bitness x86 and x64 targets on Windows x64 and on the supported Windows 11 ARM64 x64-emulation configuration. Native ARM64 capture is not currently supported, and protected, critical, identity-changed, exited, unreadable, oversized, cancelled, or timed-out targets can be refused or fail with an explicit state. Dumps can contain credentials, keys, document fragments, personal data, and unrelated content. Malware INFO stores them locally and does not upload them automatically; protect, retain, export, and share them only under your evidence policy.

.memimg is one mapped PE image captured with its pe-image.json sidecar. Use .memimg to inspect an in-memory module or injected PE-shaped image; it is not the entire process address space and is not automatically a repaired or runnable executable. .mimem is MalwareINFO's versioned custom container for structured selected resources. Use .mimem for MalwareINFO analysis and correlation of selected API-related live resources and policy-selected resources captured immediately before a supported process exit; the current terminal range-only layout differs from legacy provenance layouts, so do not assume every version embeds every provider fact. When the successful API-output registry is empty at an exact supported held self-exit, and only when the protected PreExitContext capability and active public key were negotiated, the Worker may offer bounded current-stack and observed-private-allocation metadata for Guard-owned live revalidation and encrypted range capture. This conditional fallback does not read or label bytes as API, network, or decryption output; if authority, key, readable mapping, identity, time, or storage is unavailable, the gap remains explicit. It is not automatically a whole-process dump, and periodic .mimem acquisition is not implied. .dmp is a Windows debugger container. memory.dmp is the compact MiniDump path for first-pass debugger investigation; memory-full.dmp is the broader Full User-Mode Dump path for supported user-mode debugger review. Even Full User-Mode is not physical memory. Do not infer format, completeness, trigger, target identity, capture time, byte length, SHA-256, sidecars, coverage, Partial status, or gaps from the filename. These facts come from the verified manifest and matching sidecars, not filename or extension. Two or three formats for one target can be legitimate complementary point-in-time views captured at different times, not duplicates. Static presence does not prove execution, intent, malware family, or maliciousness. Route files in every format through local evidence and MIVault handling policy. Files in every format can contain confidential credentials, cookies, keys, or documents. They are not uploaded automatically by this capture feature; analyst-selected export remains a separate deliberate action. Manual raw or full captures are not automatically sanitized or encrypted. MIVault protection and no-key omission apply only to policy-selected confidential terminal ranges: without an active public key those ranges are not stored, but that is not a blanket guarantee for other captures.

Red marks a critical or protected target for which invasive inspection, restart, or dumping is blocked. Orange means an inspectable high-privilege SYSTEM process that requires extra care and the least-invasive supported plan. Blue means a current-user process prioritized after executable private RX/RWX memory was observed or selected for payload review. Orange and blue are investigation priorities, not malware verdicts.

No. Location and account alone do not prove safety. Malware can inject into, imitate, or abuse trusted processes. Malware INFO blocks known critical/protected targets from invasive actions, displays eligible high-privilege SYSTEM processes as orange, and keeps target identity and access checks. Review path, signer, parent, command line, loaded modules, executable memory, and related activity; never force tracing against a red critical target.

Some loaders, DLL hosts, services, and malware families act only with a particular argument, working directory, token, environment, or parent context. Restarting only the executable path can produce different behavior or no behavior. Use verified launch-context evidence, preserve the original command line, and treat unsupported fields honestly. Fileless or path-unavailable processes cannot be recreated safely from an invented command.

Payload dumps are stored under C:\ProgramData\MalwareInfo\SecurityState\Guard\PayloadEvidence. API trace sessions are stored under C:\ProgramData\MalwareInfo\SecurityState\Guard\ApiTraceEvidence with per-session access control. Use Open Evidence Folder or Export Verified ZIP instead of browsing protected parent folders. For API Trace, open index.html first; it summarizes collection state, exact/correlated evidence, memory artifacts, gaps, behavior chains, and next steps. JSON/JSONL remains the checksum-covered forensic source when deeper validation is required.

Confirm that Malware INFO was installed with the official installer in the expected program folder and that it is running with the required administrative approval. Use Repair Service to replace and re-register the service, then run the service test and read the reported status. If it still fails, restart Windows and repair or reinstall the current version with the official installer. Preserve Logs\StartupError.log and the Guard or service diagnostic logs, record the Windows service error, and contact Malware INFO support if the service still cannot start.

Use the official Malware INFO installer to repair or reinstall the current version. Do not download or copy individual DLL files from another computer or an unofficial source. Malware INFO must be installed with all of its required components, and Windows must have a compatible Microsoft Edge WebView2 Runtime. If the error remains, restart Windows, run the official installer again with administrator approval, and install or repair Microsoft Edge WebView2 Runtime from Microsoft. Preserve the exact fallback error message and contact Malware INFO support if Help and reports still do not open.

There is no automatic Malware INFO cloud-analysis upload pipeline in the current architecture. Evidence stays local unless the user deliberately exports or shares it. Network features remain explicit: public feeds and updates retrieve data; licensed connectors contact the configured provider; VirusTotal lookup sends the selected indicator; a complete file is sent only after the user explicitly chooses Upload to VirusTotal and confirms. Memory evidence can contain secrets, so local storage still requires access, retention, and sharing controls.

Sidebar feature names remain canonical in every edition. An unavailable feature stays visible so users can understand the product, but its readable disabled state and access guidance show that it cannot be opened in the current edition. Help may describe a paid feature, but documentation visibility never unlocks the control and authorization is checked again when an action is requested.

Confirm why it was quarantined, validate its hash and source, review the detection engine and related activity, determine whether it is a verified false positive or an accepted business risk, and choose a controlled destination. Do not restore directly into an active startup, service, Run key, scheduled-task, or production path. If an exception is genuinely required, scope and approve it separately; restoring a file does not automatically make it trusted.

Stop active collection cleanly, use the product's report/export action, retain the manifest and SHA-256 inventory, and work from a copy. Record case ID, source computer, target PID and creation time, collection mode, UTC start/stop, analyst, product version, and any source gaps or AV actions. Transfer only through an organization-approved evidence channel and remember that a report, dump, or archive may itself trigger AV because it contains malicious material.

Official Malware INFO licenses are issued only for fixed terms of up to three years. Malware INFO does not sell a Lifetime Version or an Unlimited Features license. If a copy displays either claim, treat it as an unauthorized modified, cracked, or pirated build rather than an official edition. Stop using it, do not enter a real license key or organizational credentials, preserve its source and SHA-256 for review, scan the affected computer, and replace the software with an installer obtained through an official Malware INFO channel. Using unlicensed software may expose the user or organization to legal or contractual action, violate workplace security and acceptable-use policy, affect employment responsibilities, and introduce malicious code added by an unknown distributor.

The developer of Malware INFO spent seven years serving on a national CERT team and handling numerous APT malware and ransomware incidents in an environment with limited staffing, budgets, and specialist skills. That experience showed how difficult it can be for resource-constrained CERT and CSIRT teams to investigate incidents quickly and to support a broader, collaborative response to malware affecting users across a country. The product was created to carry that objective forward by making practical incident-analysis capability affordable to individual users and accessible to organizations of different sizes. Its price is an accessibility decision, not a claim that users should accept the product without evaluation. Malware INFO should be assessed by comparing its documented capabilities, reproducible evidence, safety boundaries, and real investigation results with other established security tools.