What’s the best way to see if something like an exe file is really a malicious file other than scanning it with AV softwares? Couldn’t it be done by executing the file inside a VM and seeing if it installed any key loggers, backdoors, password extracts, etc? How do you even do that though?