T1497.001: GPU Anti-VM Gate Check via tempdir.dll Module Load

Tim Peck@timpeck

•updated Jul 22, 2026•4•0•12

Detects the loading of 'tempdir.dll', a module identified as implementing an anti-VM/sandbox gate. This mechanism queries DXGI adapter vendor IDs (e.g., QEMU 0x1234, VMware 0x15AD), checks for low VRAM allocation, and performs compute shader timing analysis to detect virtualization or sandbox environments prior to secondary payload execution.