Identifying the existence of at least one of the VM software's files can tell if the program is running in a virtual machine. The following table contains a list of files that can be used to identify if the program is running in a VirtualBox or VMware guest:
| Virtualbox | VMWare |
| %programfiles%oraclevirtualbox guest additions system32driversVBoxGuest.sys system32driversVBoxMouse.sys system32driversVBoxSF.sys system32driversVBoxVideo.sys system32vboxdisp.dll system32vboxhook.dll system32vboxmrxnp.dll system32vboxogl.dll system32vboxoglarrayspu.dll system32vboxoglcrutil.dll system32vboxoglerrorspu.dll system32vboxoglfeedbackspu.dll system32vboxoglpackspu.dll system32vboxoglpassthroughspu.dll |
%programfiles%VMWare system32driversvm3dmp.sys system32driversvmci.sys system32driversvmhgfs.sys system32driversvmmemctl.sys system32driversvmmouse.sys system32driversvmrawdsk.sys system32driversvmusbmouse.sys |