running the virus code in a container / vm and checking what gets modified