Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Downloads MZ/PE file

Looks for VMWare Tools registry key