Enhancing malware analysis sandboxes with emulated user behavior