Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Cryptocurrency Miner

Makes network request to known mining pool URL.

Deletes itself

Executes dropped EXE

Loads dropped DLL

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

AutoIT Executable

AutoIT scripts compiled to PE executables.

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext