Behavior allows the analyst to get a detailed breakdown of the actions performed by the file during dynamic execution.
The Behavior screen is composed of several components:
- Screenshots - displays screenshots taken on the analysis machine during the file execution
- Process Tree - the process tree that was tracked during the analysis.
- Download PCAP button - download the full network capture file that was recorded during the analysis.
- Network, Service, File, Registry Activity - actions performed by the analyzed file in each category.