1. A computer implemented method of analyzing items of network content to determine whether the items of network content contain malicious network content, the method comprising: A) determining whether a probability score corresponding to each of a first plurality of items of network content satisfies an analysis threshold, the probability score is related to a probability that the corresponding item of network content includes malicious network content; B) determining, in accordance with a first processing order, at least a second plurality of items of network content that are a subset of the first plurality of items of network content, each of the second plurality of items of network content is associated with a corresponding probability score that satisfies the analysis threshold; C) generating, by a controller, a second order of processing of each of the second plurality of items of network content being associated with a corresponding probability score that satisfies the analysis threshold, the second order of processing differs from the first order of processing and is based, at least in part, on the corresponding probability scores, the controller comprising a digital device providing a virtual machine; and D) processing the second plurality of items of network content in the virtual machine in accordance with the second order of processing for subsequent analysis of behavior of the virtual machine to detect whether one or more of the items of network content include malicious network content.