In addition to the previously described trick EvilBunny performs hook detection to trick environments which hook time retrieval APIs. Every API is called twice to calculate a delta, while performing a sleep(1000) operation between iteration one and iteration two. The final condition is, if any of the three deltas is below 998 milliseconds execution will abort. This can only be the case if any of the three API’s return values is modified by a system monitoring solution, like a sandbox