Abstract: An example storage medium includes instructions that, when executed, cause a processor of a computing device to encrypt a source file that has been identified as potentially malicious, place the encrypted file in a location accessible to a virtual machine, provide, to the virtual machine, information for decrypting the encrypted file, and cause the virtual machine to use the information to process the encrypted file.

Abstract: An example non-transitory computer readable storage medium comprises instructions that when executed cause a processor of an electronic device to: in response to detecting a malware scan trigger associated with a file, determine a combined risk score associated with the file based on metadata of the file and a source of the malware scan trigger, where the source includes a file access interceptor, a file write observer, and a file indexer; determine a scan priority based on the combined risk score; and perform a malware scan on the file based on the scan priority.