Abstract: An example storage medium stores instructions that, when executed, cause a processor of a computing device to receive an indication associated with a first virtual machine, the first virtual machine containing a first application, the indication indicating that a first operation in the first virtual machine is to use a second application; receive information associated with a second virtual machine, the second virtual machine created in response to the first operation and containing the second application; store information describing a chain of virtual machines, the chain of virtual machines including the first and second virtual machines, the stored information including a relationship between the first virtual machine and the second virtual machine, based on the received indication and the received information; and in response to an identification of malware in the chain of virtual machines, identify a particular virtual machine in the chain of virtual machines that is in a kill chain of the malware based

Abstract: An example non-transitory computer readable storage medium comprises instructions that when executed cause a processor of an electronic device to: in response to detecting a malware scan trigger associated with a file, determine a combined risk score associated with the file based on metadata of the file and a source of the malware scan trigger, where the source includes a file access interceptor, a file write observer, and a file indexer; determine a scan priority based on the combined risk score; and perform a malware scan on the file based on the scan priority.

Abstract: A mobile device comprising a processor which is configured to run at least one of a plurality of threads, said plurality of threads comprising a mobile control thread, a priority adjusting thread and at least one other thread; a scheduler for scheduling threads to be run on said processor dependent on a priority of an thread relative to other threads, a display for displaying data to a user, an input system for a user to input commands, and a communication link for connecting said mobile device to a remote terminal, wherein, when said mobile control thread is running the processor is configured to capture data currently displayed on said display; send said captured data over said communication link; and issue an update sent notification to activate said priority adjusting thread; wherein, when said priority adjusting thread is running, the processor is configured to determine, on receipt of an update sent notification, whether a previous update sent notification issued less than a threshold time earlier, dete

Abstract: A mobile device comprising a processor which is configured to run at least one of a plurality of threads, said plurality of threads comprising a mobile control thread, a priority adjusting thread and at least one other thread; a scheduler for scheduling threads to be run on said processor dependent on a priority of an thread relative to other threads, a display for displaying data to a user, an input system for a user to input commands, and a communication link for connecting said mobile device to a remote terminal, wherein, when said mobile control thread is running the processor is configured to capture data currently displayed on said display; send said captured data over said communication link; and issue an update sent notification to activate said priority adjusting thread; wherein, when said priority adjusting thread is running, the processor is configured to determine, on receipt of an update sent notification, whether a previous update sent notification issued less than a threshold time earlier, dete