Executing the software in a controlled environment to monitor behavior:

[e.g., Extract hidden flag / Analyze payload / Install mod] 1. Initial Reconnaissance

Are you analyzing this for a , or is this a software installation you're documenting?