Turn one suspicious Windows endpoint into evidence you can explain.

Yes. Malware INFO Help is currently available in 22 languages:

• - العربية Arabic
• Deutsch - German
• English - English
• Español - Spanish
• Français - French
• हिन्दी - Hindi
• Bahasa Indonesia - Indonesian
• Italiano - Italian
• 日本語 - Japanese
• 한국어 - Korean
• Bahasa Melayu - Malay
• မြန်မာ - Myanmar (Burmese)
• Nederlands - Dutch
• Polski - Polish
• Português - Portuguese
• Русский - Russian
• ไทย - Thai
• Türkçe - Turkish
• Українська - Ukrainian
• Tiếng Việt - Vietnamese
• 简体中文 - Chinese (Simplified)
• 繁體中文 - Chinese (Traditional)

No. Malware INFO is an investigation and incident-analysis companion, not a replacement for antivirus, Endpoint Security, EDR, XDR, SIEM, or their prevention and response controls. It is designed to examine artifacts and evidence that an existing endpoint platform did not expose clearly enough, helping the user investigate suspicious files, processes, persistence, memory, and related incident activity in greater detail. Its guided workflows are intended to help users with foundational cybersecurity knowledge make better-informed decisions, but results still depend on evidence quality and human judgment. The stronger the operator's cybersecurity knowledge and analytical discipline, the more effectively Malware INFO can be used. Keep existing endpoint protection enabled and follow your organization's response policy.

Smart App Control is a Windows 11 protection feature that uses Microsoft's cloud-powered app intelligence and code-integrity checks to decide whether an application is trusted to run. Malware INFO has not yet been signed with a trusted code-signing certificate, so Smart App Control may treat a new or reputation-unknown release as untrusted and display an alert or block it. This does not by itself prove that Malware INFO is malicious. Until signed releases are available, obtain Malware INFO only from its official release channel and verify the published version and SHA-256. Do not weaken an organization's security policy merely to run an unverified file. United Info-Sec is working toward trusted code signing for future Malware INFO releases.

Yes. Malware INFO has been tested successfully on 64-bit Windows 7 and can be used in legacy malware-sandbox and isolated lab workflows. On tested Windows 7 systems, it may temporarily use more memory during startup and can consume approximately 2 GB more RAM than on newer Windows versions before memory usage gradually settles. Because Windows 7 has reached end of life and Microsoft does not officially support .NET 10 on it, Malware INFO provides Windows 7 compatibility on a best-effort basis rather than the same support guarantee available on current Windows versions. Keep the Windows 7 environment isolated, provide sufficient RAM, take a snapshot before analysis, and do not use an end-of-life system as an ordinary Internet-connected endpoint.

The current Malware INFO application, updater, and Guard Service are distributed for x64 Windows; there is no x86 edition of the main application at this time. The packaged x86 API Trace worker exists only to inspect eligible 32-bit target processes and does not make the main product compatible with a 32-bit PC. Malware INFO is intended for incident investigation on both supported x64 Windows client systems and eligible x64 Windows Server versions. The interactive application requires a compatible graphical desktop environment, the required Windows components and services, administrative approval, and compliance with organizational policy; a Server Core installation without the required interactive desktop cannot host the current UI directly. Normal server workloads can be investigated, while Windows critical or protected processes remain intentionally unavailable for invasive tracing or dumping to protect system stability.

Automated online checkout is not connected yet. Professional and Enterprise purchases are currently handled through confirmed Crypto (USDT) or PayPal payment instructions. Select Personal, Organization, or Reseller before choosing the edition, device quantity, and term, then contact [email protected]. Send funds only using payment details confirmed through that official address; Malware INFO does not request a wallet seed phrase, private key, or account password.

Personal is limited to one device for one, two, or three years. Organization offers 3, 10, 50, 100, or above 200 devices. Reseller offers 10, 50, 100, or above 200 independent customer licenses. Above 200 is always handled as a custom quote.

The Organization and Reseller 10-device totals are intentionally identical. The published Reseller totals are lower than Organization at 50 and 100 devices for the same edition and term. For above-200 custom quotes, the matching Reseller quote must also remain lower.

No. A reseller must use a reseller-only Portal email account. If an email account has already redeemed a customer entitlement, registered a Machine Hash, or generated a device license, that account cannot later be approved as a reseller. This prevents customer device ownership and reseller inventory from mixing in one account. If you want to become a reseller, sign in to the Portal once with a separate reseller email address and ask Malware INFO Admin to approve that reseller-only account before reseller inventory is issued.

A Temp Key represents the purchased entitlement; it is not yet the device-specific license used by Malware INFO.

1. Open the Malware INFO User Portal.
2. Sign in with the exact email address used to purchase the key or the customer email address assigned to the key by the approved reseller.
3. Activate or redeem the purchased Temp Key. The Portal will display the license edition and the number of included devices. A different Portal email account cannot redeem that email-bound key.
4. Install Malware INFO only from the official release channel approved for your account or organization.
5. Open Malware INFO and select Register.
6. Copy the Machine Hash shown by the application.
7. Return to the Portal, add the Machine Hash to an available device slot, and generate the device license key.
8. Enter that device license key in Malware INFO and activate the application.
9. Malware INFO will restart automatically after successful activation.
10. After restart, confirm that Live Protection is active. If the service is not active, open Protection Matrix from the sidebar and use Start protection service.

Keep the Temp Key, Machine Hash, and device license key private. Use only portal.malwareinfo.app and official Malware INFO installers.

No. The purchased license term is not counted from the purchase date. It begins when you first register a Machine Hash in the Portal to generate the device license. You may therefore purchase the entitlement in advance, but add the Machine Hash and generate the device license only when you are ready to deploy Malware INFO on that computer. Once activation has begun, the applicable one-year, two-year, or other purchased term runs according to the entitlement shown in the Portal.

No. An activated device license is bound to the registered Machine Hash and cannot normally be reused to activate Malware INFO on another computer. The license will not be revoked solely because another person copied or viewed that device-bound key. Keep the key private, do not publish it, and contact Malware INFO support if the Portal shows an unknown device or other unauthorized account activity.

A license confirmed to be distributed publicly with Malware INFO, used for unauthorized redistribution, or shared to bypass the licensed device and account rules will be added to the revocation list. The revoked key can no longer be used for continued licensed operation. A user who wants to continue using Malware INFO must purchase a new legitimate license. Accidental exposure of a device-bound key is reviewed separately from confirmed public software-and-license distribution.

A Redeem Key is bound to the email address recorded when the key is purchased or assigned by an approved reseller. Sign out of the Portal, then sign in with that exact purchase email address and redeem the key from that account. The Portal will show the key as invalid when it is entered from a different email account, even if the key text itself was copied correctly. If the key is still rejected from the correct purchase email, contact the seller or Malware INFO support from that same email address and provide the order or proof of purchase. Keep the key private and never send an account password.

Do not execute an unknown file on an everyday computer.

1. Preserve its original path, name, size, and SHA-256.
2. Use Threat Lookup when policy permits sharing the indicator.
3. Run Rapid Scan and Deep Signature Scan for local hash, HEX, and YARA evidence.
4. Use Zero-Day Analysis and Live Protection history for behavior context.
5. Escalate to a controlled lab only when live execution is authorized and necessary.

First read the detection source. A confirmed trusted hash, HEX signature, YARA/private rule, or user-confirmed malware-hash match is shown as a red Detected result and can send a supported file to Quarantine Vault according to the active policy. Prefer quarantine before permanent deletion because it preserves file identity, original path, detection reason, and a reversible evidence record. Delete only after incident evidence and retention decisions are complete.

A Zero-Day Analysis score by itself is heuristic AlertOnly evidence, even when the score is High or Critical. Do not call the file confirmed malware or permanently delete it from that score alone. Correlate it with Deep API Trace behavior, Payload & Memory Analyzer strings/memory evidence, signer and path context, and Rapid Scan / Deep Signature Scan results. If harmful activity is continuing, isolate the affected computer and follow the approved incident-response process while preserving evidence.

No. AlertOnly means a rule found behavior or context that needs attention but did not meet a confirmed automatic-block boundary. Red is a review-priority color, not a malware-family verdict. Read the reason, process, signer, parent, path, related file/registry/network events, and any confirmed hash, HEX, or YARA evidence before deciding to quarantine.

Observed means activity was recorded without a malicious verdict. Allowed means the current policy did not block that event; it does not certify the program as safe. AlertOnly means review is required but automatic containment was not justified. Detected means a configured confirmed-detection source matched. Quarantined means a supported file was moved into protected containment. Always read Source, Engine, Reason, Action/Decision, path, and correlation together.

Protection Matrix is the Professional and Enterprise workspace for Live Protection status and current Guard evidence. First confirm that the protection service and required engines are active. Then review Detection Events and the Process, File, Registry, Network, and Security Timeline views around the incident time. Use the filters and correlation details to connect related activity, but do not treat one color, one event, or one executable-memory transition as an automatic malware verdict. Preserve the relevant report or evidence before containment changes.

Treat the alert as unverified until the exact file is checked. Record the AV detection name, file path, product version, and SHA-256. Confirm that the package came from the approved Malware INFO distribution channel; compare a published hash when one is available; inspect the publisher signature when the release provides one; update the AV engine and security intelligence; and submit the exact file to the AV vendor as a suspected false positive. Microsoft Defender submissions can be made through Microsoft Security Intelligence file submission. If source, hash, or release identity cannot be verified, do not restore or exclude the file.

On a normal production or personal endpoint, neither should be excluded by default. If a verified Malware INFO component is falsely detected and an immediate, policy-approved workaround is essential, allow only the exact verified product file reported by the AV. A malware sample or recovered payload should remain scanned on ordinary endpoints. Live-malware exclusions belong only inside a disposable, isolated research guest and only for the shortest necessary test window.

Not necessarily. A payload dump, memory image, quarantine object, or API evidence artifact can contain the real malicious bytes recovered from the target. An AV detection on that evidence may therefore be correct even when Malware INFO itself is clean. Record the exact detected path and hash, keep it inside controlled case storage, and do not classify it as a product false positive merely because Malware INFO created the file.

Use two separate passes. Pass 1—protection-on: keep the AV enabled, record its detection and timing, preserve Guard/AV evidence, and complete all static analysis possible. Pass 2—controlled execution: only when authorized behavior evidence is still required, revert a disposable analysis VM to a clean snapshot, disconnect it from production networks, disable host integration, place the sample in a dedicated guest-only lab folder, and apply the narrowest temporary guest exclusion only if the AV still prevents the approved test. Start Malware INFO monitoring before launch, stop collection after the planned window, preserve checksums and reports, then revert or destroy the guest.

1. Use a disposable full VM or an organization-approved sandbox; a full VM is preferable when Guard Service installation, restart, command-line replay, or longer observation is required.
2. Take a clean snapshot before importing the sample.
3. Remove corporate accounts, browser sessions, tokens, VPNs, SSH keys, password managers, and real documents.
4. Disable shared clipboard, drag-and-drop, shared folders, host-drive mapping, USB passthrough, and unnecessary guest integrations.
5. Use no network or a controlled malware-lab network with no route to production.
6. Prepare monitoring and evidence storage before launch.
7. Revert or destroy the guest after collection.

Do not execute the sample. Limit the case to static hash, signature, YARA, PE, strings, HEX, reputation, existing Guard history, and already-collected evidence. Preserve the artifact according to policy and transfer the case to an authorized team or lab. Lack of a lab is not a reason to disable AV or create sample exclusions on a production computer.

Not on the host or an ordinary endpoint. Full AV disablement removes unrelated protection and makes operator mistakes harder to contain. In an approved disposable guest, a tightly controlled team may temporarily change protection only when the research objective cannot be met with a narrow path/file rule, but that is an exceptional laboratory decision requiring authorization, isolation, a fixed time window, and mandatory snapshot reversion—not normal Malware INFO setup guidance.

Default to no network. If network behavior must be observed, use a controlled lab segment or simulation service with no route to production, management interfaces, shared storage, printers, identity services, or the host. Capture DNS and connection evidence, apply egress limits, and obtain authorization before allowing any external communication. Do not let a sample contact real victims, scan third parties, send spam, or exfiltrate captured data.

Stop the API/Payload session, export the human-readable report and checksum inventory through the approved evidence workflow, record the sample and report hashes, and close the test. Do not return the guest to normal use. Revert to the clean snapshot or destroy the VM. Remove any temporary AV rule from the reusable base image and verify that no shared folder, clipboard, mounted image, or removable media still exposes sample bytes.

No. Malware INFO observes, scans, correlates, dumps, and helps contain supported activity, but it is not a virtualization boundary and cannot guarantee interception of every exploit, kernel driver, direct syscall, credential theft, network action, destructive operation, or anti-analysis technique. Unknown code must still be treated as hostile and executed only inside an authorized isolated environment.

Safe Trace is the least-invasive selected-process timeline: it correlates available Guard, Event Log, ETW, runtime, and snapshot evidence without attaching a debugger or injecting into the target. Deep Trace is an explicit matching-bitness debugger workflow that can capture supported API entry/return evidence and bounded parameters, but it changes timing, may trigger anti-debug behavior, has target eligibility limits, and is never automatic. Use Safe first; choose Deep only when exact supported API calls are required and the lab accepts the added impact.

No. A dump proves that bytes were readable from a selected memory region at a recorded time. JIT runtimes, browsers, compatibility layers, security tools, and packers can also create executable private memory. Correlate the region with its MZ/PE identity, entropy, strings, protection transitions, writer/thread origin, API timeline, process path, signer, network/file/persistence activity, and the Payload & Memory Analyzer report before assigning a malware conclusion.

Not reliably from one memory chunk. The Enterprise analyzer performs bounded static PE/raw-memory inspection, strings and HEX preview, capability review, and matching session JSON/JSONL correlation. It can describe architecture, artifact shape, capabilities, and behavior leads, but those are analyst hypotheses rather than a guaranteed family attribution.

Red marks a critical or protected target for which invasive inspection, restart, or dumping is blocked. Orange means an inspectable high-privilege SYSTEM process that requires extra care and the least-invasive supported plan. Blue means a current-user process prioritized after executable private RX/RWX memory was observed or selected for payload review. Orange and blue are investigation priorities, not malware verdicts.

No. Location and account alone do not prove safety. Malware can inject into, imitate, or abuse trusted processes. Malware INFO blocks known critical/protected targets from invasive actions, displays eligible high-privilege SYSTEM processes as orange, and keeps target identity and access checks. Review path, signer, parent, command line, loaded modules, executable memory, and related activity; never force tracing against a red critical target.

Some loaders, DLL hosts, services, and malware families act only with a particular argument, working directory, token, environment, or parent context. Restarting only the executable path can produce different behavior or no behavior. Use verified launch-context evidence, preserve the original command line, and treat unsupported fields honestly. Fileless or path-unavailable processes cannot be recreated safely from an invented command.

Memory Payload Capture evidence is stored under C:\ProgramData\MalwareInfo\SecurityState\Guard\PayloadEvidence. API Trace sessions are stored under C:\ProgramData\MalwareInfo\SecurityState\Guard\ApiTraceEvidence with per-session access control. Use Open Evidence Folder or Export Verified ZIP instead of browsing protected parent folders. For an API Trace session, open index.html first; it summarizes collection state, exact/correlated evidence, memory artifacts, gaps, behavior chains, and next steps. JSON/JSONL remains the checksum-covered forensic source when deeper validation is required.

Confirm the application was installed as one complete matching build under the expected program folder and that it is running with the required administrative approval. Use Repair Service to replace and re-register the service boundary, then run the service test and read the reported status. If it still fails, preserve Logs\StartupError.log and Guard/service diagnostic logs, record the Windows service error, and avoid repeatedly mixing Debug, Release, or older GuardService files.

Use one complete Fresh deployment instead of copying selected Debug/Release files. MalwareInfo.exe must retain its packaged WebView2Loader.dll and managed dependencies, and the computer must have a compatible Microsoft Edge WebView2 Runtime. If WebView cannot initialize, the fallback message identifies the missing runtime or loader. Reinstall the current Fresh package and WebView2 Runtime rather than copying one DLL from another build.

There is no automatic Malware INFO cloud-analysis upload pipeline in the current architecture. Evidence stays local unless the user deliberately exports or shares it. Network features remain explicit: public feeds and updates retrieve data; licensed connectors contact the configured provider; VirusTotal lookup sends the selected indicator; a complete file is sent only after the user explicitly chooses Upload to VirusTotal and confirms. Memory evidence can contain secrets, so local storage still requires access, retention, and sharing controls.

Security Connectors is an Enterprise-only outbound integration. It can send normalized, authorized Guard or Zero-Day security events to organization-approved HTTPS receivers such as a SIEM, XDR, SOAR, firewall, IDS/IPS, or managed gateway. Malware INFO does not open an inbound SIEM port or grant arbitrary remote control. Any containment request must use the configured approved gateway, policy checks, audit records, and a validated applied, rejected, or failed result; a delivered event or accepted receipt alone does not prove that an action was enforced. Enable file-path sharing and automated actions only when organizational policy permits them.

Startup & Persistence Manager is an Enterprise workflow that inventories supported Registry Run and RunOnce values, Startup Folder items, and executable Scheduled Tasks. An authorized analyst can disable or remove a selected supported item through a transaction-backed workflow that records a restore journal. Review the publisher, path, owner, purpose, creation time, and related process activity before changing anything. A persistence entry is not automatically malicious, and unsupported persistence mechanisms must be investigated with other evidence.

Use Update Center to keep three update jobs separate: Program Update for Malware INFO application files, Signature Update for public detection content, and Enterprise Local Update for organization-controlled detection packages. Use only the source configured by the application or your organization, review the offered version and channel, and verify the published hash or signature when supplied. Do not copy selected files from another build or mix old application, updater, Guard Service, and worker components; install one complete matching package.

No. Version 1.2.1 can display the Memory Forensics workspace and its Help guide as an in-development advertisement and Developer preview, but Free, Professional, and Enterprise licensing alone does not enable public analysis. No real Windows build or production memory-image format is currently claimed as supported. The existing Enterprise Memory Payload Capture and Payload & Memory Analyzer features work with selected-process evidence and are separate from offline physical-memory or crash-dump analysis. Do not purchase an edition on the assumption that the future offline Memory Forensics subsystem is already generally available.

They are short access hints, not errors. A Free user sees Professional-capable features as (Pro/Ent Version) and Enterprise-only features as (Ent Version). A Professional user sees only Enterprise-only features marked (Ent Version). Enterprise users see no suffix. Help may describe a paid feature to explain the product, but documentation visibility never unlocks the control.

Confirm why it was quarantined, validate its hash and source, review the detection engine and related activity, determine whether it is a verified false positive or an accepted business risk, and choose a controlled destination. Do not restore directly into an active startup, service, Run key, scheduled-task, or production path. If an exception is genuinely required, scope and approve it separately; restoring a file does not automatically make it trusted.

Final Report to CISO is an Enterprise-only final reporting workspace, not another scanner. It validates supported structured packages from API Trace, Live Protection Guard evidence, and Payload & Memory Analyzer; preserves source identities, hashes, and evidence links; correlates independent observations; and exposes contradictions and collection gaps before producing a decision-focused 12-section narrative.

1. Create one case folder and copy each complete supported evidence package into it without renaming or separating files from its manifest.
2. Open Final Report to CISO, select the case folder, and validate the packages.
3. Enter the case ID, incident title, and business context, then choose the appropriate redaction mode.
4. Review source coverage, integrity, correlated findings, contradictions, known unknowns, collection gaps, and recommended actions.
5. Explicitly confirm the human review and export a new verified ZIP containing the offline HTML report, executive PDF, normalized JSON, source inventory, and SHA-256 manifest.

The workflow runs locally and offline with deterministic rules. It does not require cloud AI, upload case evidence, execute recovered content, scan or quarantine files, change endpoint state, or make an automatic malware verdict. An Incident Handler must review and approve the report and remains responsible for containment, disclosure, and attribution decisions.

Stop active collection cleanly, use the product’s report/export action, retain the manifest and SHA-256 inventory, and work from a copy. Record case ID, source computer, target PID and creation time, collection mode, UTC start/stop, analyst, product version, and any source gaps or AV actions. Transfer only through an organization-approved evidence channel and remember that a report, dump, or archive may itself trigger AV because it contains malicious material.

Official Malware INFO licenses are issued only for fixed terms of up to three years. Malware INFO does not sell a Lifetime Version or an Unlimited Features license. If a copy displays either claim, treat it as an unauthorized modified, cracked, or pirated build rather than an official edition.

Stop using it, do not enter a real license key or organizational credentials, preserve its source and SHA-256 for review, scan the affected computer, and replace the software with an installer obtained through an official Malware INFO channel. Using unlicensed software may expose the user or organization to legal or contractual action, violate workplace security and acceptable-use policy, affect employment responsibilities, and introduce malicious code added by an unknown distributor.