Adevice (230, 300), comprising: one or more memories; and one or more processors, operatively connected to the one or more memories, to: receive a file (125, 410) that has been downloaded to a first user device or that is to be downloaded to the first user device, wherein the file is to be subject to a malware detection procedure (400, 500, 600); process the file to determine one or more file identification properties, obtain metadata (135, 430) identifying user interactions associated with the file based on the one or more file identification properties, wherein the metadata is generated by capturing user interactions with a set of interface objects that are displayed as part of processes of a plurality of files received at the first user device or at one or more other user devices, and wherein the user interactions are used to pass a human verification test that is presented by the file, wherein the user interactions include at least one of: a first group of user interactions that were performed when the file or a same type of file was previously accessed on the first user device, or a second group of user interactions that were performed when the file or a same type of file was previously accessed on the one or more other user devices; test (140, 440) the file in a sandbox environment to obtain a result, wherein the one or more processors, when testing the file, are to: execute the file, perform the user interactions that are identified by the metadata, and execute the malware detection procedure to determine whether the file is malware; and provide a notification (145-1, 145-2, 450) that includes the result to the first user device to cause the first user device to perform one or more actions when the file is malware. one or more memories; and one or more processors, operatively connected to the one or more memories, to: receive a file (125, 410) that has been downloaded to a first user device or that is to be downloaded to the first user device, wherein the file is to be subject to a malware detection procedure (400, 500, 600); process the file to determine one or more file identification properties, obtain metadata (135, 430) identifying user interactions associated with the file based on the one or more file identification properties, wherein the metadata is generated by capturing user interactions with a set of interface objects that are displayed as part of processes of a plurality of files received at the first user device or at one or more other user devices, and receive a file (125, 410) that has been downloaded to a first user device or that is to be downloaded to the first user device, wherein the file is to be subject to a malware detection procedure (400, 500, 600); process the file to determine one or more file identification properties, obtain metadata (135, 430) identifying user interactions associated with the file based on the one or more file identification properties, wherein the metadata is generated by capturing user interactions with a set of interface objects that are displayed as part of processes of a plurality of files received at the first user device or at one or more other user devices, and wherein the user interactions are used to pass a human verification test that is presented by the file, wherein the user interactions include at least one of: a first group of user interactions that were performed when the file or a same type of file was previously accessed on the first user device, or a second group of user interactions that were performed when the file or a same type of file was previously accessed on the one or more other user devices; test (140, 440) the file in a sandbox environment to obtain a result, wherein the one or more processors, when testing the file, are to: execute the file, perform the user interactions that are identified by the metadata, and execute the malware detection procedure to determine whether the file is malware; and provide a notification (145-1, 145-2, 450) that includes the result to the first user device to cause the first user device to perform one or more actions when the file is malware. wherein the user interactions include at least one of: a first group of user interactions that were performed when the file or a same type of file was previously accessed on the first user device, or a second group of user interactions that were performed when the file or a same type of file was previously accessed on the one or more other user devices; test (140, 440) the file in a sandbox environment to obtain a result, a first group of user interactions that were performed when the file or a same type of file was previously accessed on the first user device, or a second group of user interactions that were performed when the file or a same type of file was previously accessed on the one or more other user devices; test (140, 440) the file in a sandbox environment to obtain a result, wherein the one or more processors, when testing the file, are to: execute the file, perform the user interactions that are identified by the metadata, and execute the malware detection procedure to determine whether the file is malware; and execute the file, perform the user interactions that are identified by the metadata, and execute the malware detection procedure to determine whether the file is malware; and provide a notification (145-1, 145-2, 450) that includes the result to the first user device to cause the first user device to perform one or more actions when the file is malware.