1. A method for detection of computer malware, the method comprising: monitoring execution of processes or threads of one or more software objects; determining if the one or more objects are trusted objects or non-trusted objects; storing, in a plurality of separate object contexts, events of execution of the monitored processes or threads of each non-trusted object; determining if the monitored processes or threads stored in separate object contexts are related to each other; merging events stored in the object contexts of related processes or threads into a common context; and analyzing the events of the monitored processes or threads stored both in the common context and in separate object contexts using malware behavior rules to identify malicious objects.