1. A computing apparatus, comprising: a memory including a locally-executing software process; and one or more logic elements, including at least a processor, comprising an execution profiling engine configured for: concurrent with the locally-executing software process, inspecting a segment of the software process; before executing the segment, determining that the segment will produce an exception condition when the segment runs; checking transfer target addresses against a list of addresses and address ranges commonly used by malware; validating that the software process is owned by a legitimate software module; subjecting the software process to additional security analysis to identify malicious behavior; designating the software process as potentially malicious; and taking a security action related to the software process, comprising designating the software process for additional analysis.