1. A non-transitory computer readable medium comprising instructions stored thereon to cause one or more processing units to: detect an execution of a payload by utilizing interface monitoring; scan process memory associated with the execution of the payload for a match against at least one of a plurality of signatures representing known unwanted data; perform a behavioral analysis to determine an amount of the payload that has executed; and reduce a level of interface monitoring and a level of process memory scanning after a predetermined amount of the payload has executed and unwanted data has not been detected based on the act of scanning process memory.