1. A method comprising: receiving information about an executable file residing on a host computer that, when executed on the host computer, initiates a network connection; receiving information about the network connection; analyzing the information about the executable file to determine whether the executable file has a malicious disposition; and analyzing the information about the network connection depending on a disposition of the executable file to determine whether the network connection is malicious.