Cyber Triage Malware Forensics Tool is a digital forensics solution that scans executable and library files for malware using over 40 scanning engines from ReversingLabs. The tool collects files from investigated hosts, including those associated with running processes, startup items, and previously launched programs. The tool offers multiple analysis methods: hash-based lookups to check if files have been previously analyzed, file content uploads for engine analysis, local Yara rule application, and sandbox analysis through Recorded Future integration. Files are sent to a private repository rather than public services, with only PE format executables and libraries uploaded to limit PII exposure. For air-gapped environments, the tool supports offline mode where hash values can be exported to text files, uploaded to an Internet-facing computer, and results imported back into Cyber Triage. Users maintain control over upload settings, with options to prevent file uploads entirely through special licenses. The licensing model includes tiered limits: base limits (such as 5,000 lookups per day for Team licenses), flex lookups (1,000 per month included), and boost codes that can be purchased for additional capacity during large incidents. The tool is designed for incident responders and DFIR professionals conducting host-based investigations.