1. A system configured to detect malware comprising: a data collector configured to: detect at least a first hypertext transfer object in a chain of a plurality of hypertext transfer objects; analyze at least said first hypertext transfer object for one or more events; and generate a list of events based on said analysis of at least said first hypertext transfer object.