1. A computer-implemented method for detecting malicious behavior of a computer program, comprising: emulating at least a part of a computer system in an isolated computer environment; emulating execution of the computer program in the isolated computer environment, including emulating execution of a first process and a second process of the computer program; monitoring events being generated by the first process and the second process; and determining, substantially in real time, based on at least one or more event generated by the first process and one or more event generated by the second process whether or not the computer program exhibits malicious behavior.