A hacker wants to install a keylogger on a victim's computer but notices the original executable is detected by the victim's antivirus. A sample of the original executable is: In an effort to avoid…

A hacker wants to install a keylogger on a victim's computer but notices the original executable is detected by the victim's antivirus. A sample of the original executable is:

In an effort to avoid detection, the hacker attempts to modify the executable but it is always detected. The hacker concludes that kernel hooking is being detected. The victim's antivirus is employing which detection method to detect this keylogger?