Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with <code>.Md5.exe</code>, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.