A method for determining the threat level of a sample, comprising: a. providing a multi-analyzer array running on a server comprising a static analyzer, a plurality of dynamic analyzers, an arbitrator, at least one post processing process, and a normalizer process; wherein said plurality of dynamic analyzers comprises a plurality of sandboxes, wherein said plurality of sandboxes comprise sandboxes of different developers, and wherein at least one of said plurality of dynamic analyzers comprises a sandbox-less environment, wherein said sandbox-less environment comprises application modules designed to simulate human activity; b. analyzing the sample by said static analyzer to produce a static analysis, wherein the static analysis includes determining the expected behavior of the sample including altering of registry values; c. review of said static analysis by said arbitrator to determine which of said plurality of dynamic analyzers to utilize for dynamic analysis of said sample; d. analyzing the sample by one of said plurality of dynamic analyzers as chosen by said arbitrator to produce a dynamic analysis of said sample, e. normalizing said dynamic analysis by said normalizer to a format for post processing by said at least one post processing process; f. analyzing the normalized dynamic analysis by said at least one post processing process to provide a post processing analysis and to determine a threat level of said sample; and g. analyzing by said arbitrator of said post processing analysis and said threat level of said sample to determine whether to further analyze said sample in one of said plurality of dynamic analyzers not previously chosen by said arbitrator, wherein the determining whether to further analyze said sample includes when the expected behavior of the sample included altering of registry values and wherein the registry values were not altered, further analyzing said sample in one of the plurality of dynamic analyzers not previously chosen by said arbitrator. a. providing a multi-analyzer array running on a server comprising a static analyzer, a plurality of dynamic analyzers, an arbitrator, at least one post processing process, and a normalizer process; wherein said plurality of dynamic analyzers comprises a plurality of sandboxes, wherein said plurality of sandboxes comprise sandboxes of different developers, and wherein at least one of said plurality of dynamic analyzers comprises a sandbox-less environment, wherein said sandbox-less environment comprises application modules designed to simulate human activity; b. analyzing the sample by said static analyzer to produce a static analysis, wherein the static analysis includes determining the expected behavior of the sample including altering of registry values; c. review of said static analysis by said arbitrator to determine which of said plurality of dynamic analyzers to utilize for dynamic analysis of said sample; d. analyzing the sample by one of said plurality of dynamic analyzers as chosen by said arbitrator to produce a dynamic analysis of said sample, e. normalizing said dynamic analysis by said normalizer to a format for post processing by said at least one post processing process; f. analyzing the normalized dynamic analysis by said at least one post processing process to provide a post processing analysis and to determine a threat level of said sample; and g. analyzing by said arbitrator of said post processing analysis and said threat level of said sample to determine whether to further analyze said sample in one of said plurality of dynamic analyzers not previously chosen by said arbitrator, wherein the determining whether to further analyze said sample includes when the expected behavior of the sample included altering of registry values and wherein the registry values were not altered, further analyzing said sample in one of the plurality of dynamic analyzers not previously chosen by said arbitrator.