I tested TM against some malware samples (Hypersensitive mode enabled).

1. Some samples were identified by TM malware signatures.

2. Some samples were first blocked by "Suspicious behavior detected" and then by signatures.

3. Some samples were blocked by "suspicious behavior detected" and no signature detection afterwards.

In case "1", local signature database is used? In case "2" no local database signature found, but cloud lookup flagged it?

I also do like to know how Hypersensitive mode actually works? Is it some kind of a "default-deny" method?

What i also do like to see when a program gets flagged by "Suspicious behavior blocked", why it gets blocked? Malformed PE-header? DLL sideloading? So what was the reason it gets blocked.