Many novice researchers try the same checklist:
This is Themida’s favorite. VMware and VirtualBox expose a "backdoor" communication channel via I/O ports (e.g., 0x5658 for VMware, 0x10 for VirtualBox). Themida executes in or out instructions to these ports. If the port responds with a magic number (e.g., 0x564D5868 for VMware), the VM is confirmed. themida bypass vm detection
Themida-protected 32-bit executable (detects VMware). Many novice researchers try the same checklist: This