1. A computer-implemented method for tracking malware execution on a client computer, the method comprising: detecting at the client computer a potential malware application; collecting at the client computer threat information about the potential malware application, wherein the threat information includes executable code of the potential malware application itself and environment information describing configuration settings of the client to allow recreating the client environment at an analysis server and executing the potential malware application for analysis in an environment that reproduces at a server the specific environment in which the potential malware application would execute on the client computer including the collected configuration settings of the client from which the executable code of the potential malware application was collected, and wherein the threat information also includes historical data from the client computer that indicates how the potential malware application initiated each action, such that the server, upon collecting potential malware applications from two different clients A and B will execute the malware two separate times in two separate environments: 1) the recreated environment of client A, and 2) the recreated environment of client B based on the specific configuration settings collected from A and B; submitting from the client computer the threat information to a back-end service for further analysis; receiving at the client computer a threat signature and mitigation information from the back-end service, wherein the signature includes data for detecting a threat confirmed by the back-end service; and applying on the client computer one or more mitigation actions to the detected potential malware application based on the signature received from the back-end service.