a plurality of untrusted digital files are run simultaneously in fewer sandboxes than there are files , while monitoring for malicious activity . preferably , only one sandbox is used . if the monitoring detects malicious activity , either the files are run again in individual sandboxes , or the files are divided among subsets whose files are run simultaneously in one or more sandboxes , while monitoring for malicious activity .