count every API from each malware from sandbox result