In short, an antivirus tries to detect malicious files by their behavior. Therefore, this detection is in two stages. The first stage is Scantime and the next stage is Runtime. In the Scantime step, the files scan before running on the operating system. Also, in the Runtime stage, the files are scanned during execution. watch how our software these stages bypass Windows Defender in Windows 11.