1. In a computing environment, a method performed at least in part on at least one processor, comprising, detecting malware in an input file, including by allowing the input file to be opened, monitoring for one or more behaviors corresponding to that file that indicate possible malware, and recording events corresponding to the file.