Behavior Blocker intercepts all files before they are loaded into memory, calculates the hash of the executable at the point it attempts to load into the memory,then compares them, if the hash matches, the Behavior Blocker allows it to run.