Executing malware in a controlled environment is one of the most popular and effective methods of extracting the behavior characters of malware. In this paper, we propose a dynamic analysis technique to explore the