1. A system configured to detect malware comprising: a device on a network to: intercept one or more communication packets in transit between a first digital device and a second digital device on the network; analyze a payload of at least one of the one or more communication packets; detect, based on analyzing the payload, one or more hypertext transfer objects, in a chain of a plurality of hypertext transfer objects, in the payload in transit between the first digital device and the second digital device on the network; analyze the one or more hypertext transfer objects for one or more events; generate a list of events based on analyzing the one or more hypertext transfer objects; determine a score based on at least one of a file format or a header within the one or more hypertext transfer objects; determine that the one or more hypertext transfer objects is a suspicious sequence of hypertext transfer objects based on the score satisfying a threshold; and instantiate a browser cooking environment based on determining that the one or more hypertext transfer objects is the suspicious sequence of hypertext transfer objects.