1. A computer-implemented method, comprising: accessing, by an analysis console, information related to a first file received at a first host of a plurality of hosts, each host running a corresponding set of malware detection processes, the information comprising: an identifier of the first file, the identifier generated by the first host, the identifier usable by each of the plurality of hosts to determine whether a second file comprises content substantially equivalent to content of the first file; a time limit for completing a further malware analysis; data indicating a first result of the first host applying the set of malware detection processes to the first file, the first result being inconclusive as to whether the first file contains malware; and a reason indicating why the first file is suspected of containing malware; performing, by the analysis console within the time limit, the further malware analysis of the first file based at least in part on the first result; generating, by the analysis console, a first output based at least in part on the first result, the first output comprising: the identifier of the first file; a second result indicating conclusively whether the first file comprises malware based on the further malware analysis, the second result usable by each of the plurality of hosts to determine whether the second file comprises malware based on a determination that the second file comprises content substantially equivalent to content of the first file; and propagating the first output to the plurality of hosts.