Checks QEMU agent state file

Checks state file used by QEMU agent, possibly to detect virtualization.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Modifies service

Suspicious use of NtSetInformationThreadHideFromDebugger