Follow the development of Malware INFO, including major feature additions, interface improvements, compatibility changes, and verified bug fixes.
1.2.1
Version 1.2.1 — Product-Wide Final Release
Released
Release date
August 22, 2026
Release type
Product-wide security, analysis, protection, and workflow release
Version 1.2.1 is the public product-wide Malware INFO release published on August 22, 2026. It extends beyond the redesigned interface to scanning, endpoint visibility, evidence acquisition, selected-process memory analysis, reporting, Help and localization, licensing, packaging, and operational reliability. Feature-specific Developer Preview, AlertOnly, Future Plan, Partial, and Unsupported boundaries remain unchanged by the product release.
Product and workflow modernization
Introduces the Command Center, Scan Studio, Protection Matrix, Advanced Analysis, Reports & Evidence, Administration, and Help Center workspaces within a reorganized navigation system.
Redesigns major screens, navigation, tabs, action areas, evidence views, tables, status presentation, and responsive layouts for clearer day-to-day analyst workflows.
Improves feature discovery and edition-aware presentation while keeping unavailable, partial, degraded, unsupported, and recovery-required states visible.
Aligns product terminology and workflow guidance across the application, built-in Help, Website, and GitHub documentation.
Scanning, protection, and investigation
Brings Rapid Scan, Deep Signature Scan, Zero-Day Analysis, Threat Lookup, and related local evidence review into the Scan Studio workflow.
Expands Live Protection and Protection Matrix visibility across threat events, process activity, file activity, registry activity, network activity, and the security timeline.
Improves exact-target investigation workflows for process, file, registry, network, persistence, quarantine, and related endpoint evidence.
Strengthens Ransomware Shield, Startup & Persistence Manager, Security Connectors, Quarantine Vault, Detection Library, and local update and administration workflows.
Retains conservative evidence semantics: unavailable collection is not reported as clean, and review-only findings do not become automatic containment authority.
Memory evidence and reporting
Expands Process Memory Capture with bounded, exact-process acquisition workflows and explicit partial, unsupported, cancelled, and recovery-required outcomes.
Improves Payload & Memory Analyzer handling for supported capture formats, reconstructed artifacts, local static evidence, and protected evidence boundaries.
Correlates supported memory, process, API trace, and endpoint evidence without treating missing context as benign evidence.
Adds provenance-aware evidence handoff and Final Report to CISO workflows for reviewable analyst and executive reporting.
API Hook Trace — Enterprise Developer Preview
API Hook Trace is carried in Version 1.2.1 only as an Enterprise Developer Preview; it is not the production API Hook Trace release.
Restricted tracing actions remain FeatureTest and require both Enterprise entitlement and valid developer authorization at action time.
Preview evidence remains AlertOnly. Automatic containment is not authorized.
Production enablement remains planned for Version 1.3 and depends on release-candidate signing, installed x86 and x64 runtime validation, protected-evidence validation, recovery testing, and performance evidence.
Help, localization, licensing, and delivery
Updates the built-in Help system with current feature guidance, safety boundaries, Edition Comparison, FAQ, and Version & Build History content.
Maintains Help and public Website content across 22 languages while the main program interface remains English.
Updates Website, GitHub, installer branding, screenshots, product terminology, and public documentation around the current application structure.
Publishes the exact Free x64 MSI, filename, byte length, and SHA-256 sidecar through the official Malware INFO download channel.
Published installer and release boundary
The public Free installer is MalwareInfo-Setup-1.2.1.0-x64.msi, published at https://download.malwareinfo.app/free/1.2.1.0/MalwareInfo-Setup-1.2.1.0-x64.msi.
The 81,371,989-byte MSI has SHA-256 8f5bd78a5c81a5143887caafc576b765efb0097c598642f03f4af667c9bfb819; the matching checksum sidecar is published beside the installer.
The published MSI is not digitally signed. Windows may show Unknown Publisher or Smart App Control warnings; verify the exact SHA-256 and follow organizational policy rather than weakening endpoint security controls.
Developer Preview, Experimental, Partial, AlertOnly, Unsupported, and Not Performed boundaries remain visible and are not converted into production-support claims.
1.3
Version 1.3 — API Hook Trace & Offline Windows Memory Forensics
Future Plan
Release date
Not scheduled
Release type
Planned runtime-tracing and offline forensic-analysis expansion
Version 1.3 is planned to deliver the production API Hook Trace workflow and an independently engineered, Windows-only offline memory-forensics subsystem. Both areas remain validation-gated Future Plan objectives. They will be presented as available product capabilities only after their exact release, security, compatibility, recovery, and representative-evidence gates pass.
Planned API Hook Trace production release
Controlled x86 and x64 target launch with exact process identity, explicit analyst authorization, architecture-matched workers, and bounded session ownership.
Supported API call timelines with function identity, supported arguments and return values, process and thread context, timestamps, and coverage diagnostics.
Protected handling for supported strings, file content, command, registry, and related evidence without exposing sensitive raw material in ordinary logs or reports.
Bounded stop, finalization, cancellation, and recovery workflows that preserve partial evidence and report Recovery Required when cleanup or restoration cannot be proven.
Evidence export and report integration for analyst review, including provenance, gaps, contradictions, unsupported fields, and Final Report to CISO intake where validated.
API Hook conclusions will remain AlertOnly unless later release evidence and reviewed policy explicitly authorize a different ceiling. Automatic containment is not planned.
Planned offline memory investigation areas
Read-only analysis of supported Windows 10 and Windows 11 x64 raw physical-memory images.
Analysis of eligible Windows full crash dumps and kernel crash dumps when the required memory pages are present.
Identification and correlation of processes, threads, loaded modules, user sessions, memory regions, and related system evidence.
Review of private or executable memory, reconstructed in-memory PE evidence, recovered payload candidates, and supported YARA or static-analysis findings.
Examination of validated registry, service, persistence, handle, file-object, and network-endpoint artifacts.
Review of supported kernel modules, drivers, callbacks, timers, devices, and pointer-ownership evidence.
Evidence-based correlation for possible process injection, hollowing, manual mapping, module inconsistencies, and other memory-resident activity.
Core memory parsing, hashing, correlation, extraction, YARA scanning, and reporting are planned to run locally on the analyst's workstation or an organization-controlled system.
Memory images, recovered pages, files, strings, host information, and case evidence will not be uploaded automatically.
Recovered content will be treated as untrusted evidence and will never be executed by the memory-forensics subsystem.
Validation and support boundary
Support will be Windows-build-specific and will be published only after exact symbol identity, parser behavior, and representative fixtures pass validation.
Incomplete, truncated, corrupted, smeared, or missing-page images may produce explicit Partial, Unsupported, Corrupt Input, or Missing Memory results.
Unavailable structure layouts or missing evidence will not be guessed or silently replaced with invented values.
Not included in the initial plan
Live-memory acquisition, malware execution, and credential, password, secret, hash, or key extraction.
x86 or ARM64 memory images, Linux or macOS memory analysis, and hibernation-file decompression.
Proprietary Hyper-V, VMware, or VirtualBox saved-state and snapshot parsing.
Before 1.2.1
Legacy Foundation — Before 1.2.1
Historical Baseline
Release date
Before the Version 1.2.1 redesign
Release type
Pre-1.2.1 product foundation
Before the Version 1.2.1 product-wide modernization, Malware INFO already provided a local-first investigation environment for examining suspicious files, system activity, indicators, memory evidence, and endpoint artifacts.
Established capability areas
Threat Lookup and indicator investigation.
Local file reputation, computed hash, HEX pattern, signature, YARA rule, and other static-evidence review.
Rapid Scan, Deep Signature Scan, and Zero-Day Analysis.
Live Protection monitoring for file, registry, process, network, timeline, and memory-related evidence.
File, process, registry, network, timeline, persistence, and related endpoint-artifact investigation.
Quarantine Vault, Reports & Evidence, Detection Library, and Update Center workflows.
Evidence preservation, report and export workflows, and local or private detection-data management.
Threat Intelligence, Threat Briefing, Vulnerability Alerts, and licensed-provider intelligence workflows.
Ransomware Shield, Security Connectors, and Startup & Persistence Manager.
