Malware INFOLocal-first Windows incident analysis
Security, privacy, and evidence limits
Malware INFO does not make it safe to execute unknown code on a normal computer. It cannot guarantee interception of every exploit, driver, direct syscall, credential theft, destructive action, or evasion technique.
Security, privacy, and evidence limits
Evidence stays local unless the user deliberately exports or shares it. VirusTotal lookup sends the selected indicator; a complete file is sent only after the user explicitly chooses Upload to VirusTotal and confirms.
Observed and Allowed do not mean safe. AlertOnly means review is required. Detected means a configured confirmed source matched. Quarantined means supported file containment succeeded.
Malware INFO does not make it safe to execute unknown code on a normal computer. It cannot guarantee interception of every exploit, driver, direct syscall, credential theft, destructive action, or evasion technique.
Guided API Trace is least invasive. Deep API Trace changes timing, may trigger anti-debug behavior, and has target limits. Use it only when exact supported API evidence is necessary and the lab accepts the impact.
An RX/RWX dump proves readable bytes existed at a recorded time. Correlate identity, protection changes, writer/thread origin, timeline, signer, network, file, and persistence context.
Payload & Memory Analyzer remains Enterprise-only: bounded review of supported EXE/DLL/SYS, MSI and legacy Office .doc files, supported .memimg/.dmp memory artifacts, and matching evidence correlation. Format, architecture and provenance limits apply. Crypto Lab provides offline config and key analysis for active Professional and Enterprise licenses; inputs and recovered bytes are never executed or uploaded.