GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-05-19 11:49:44 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000068 ST1000LM rev.2BA3 931,51GB Running: l803oi2g.exe; Driver: C:\Users\RADOSA~1\AppData\Local\Temp\kwryrpob.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075a88769 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075b81401 2 bytes JMP 75aab233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075b81419 2 bytes JMP 75aab35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075b81431 2 bytes JMP 75b29149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075b8144a 2 bytes CALL 75a84885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075b814dd 2 bytes JMP 75b28a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075b814f5 2 bytes JMP 75b28c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075b8150d 2 bytes JMP 75b28938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075b81525 2 bytes JMP 75b28d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075b8153d 2 bytes JMP 75a9fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075b81555 2 bytes JMP 75aa6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075b8156d 2 bytes JMP 75b29201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075b81585 2 bytes JMP 75b28d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075b8159d 2 bytes JMP 75b288fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075b815b5 2 bytes JMP 75a9fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075b815cd 2 bytes JMP 75aab2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075b816b2 2 bytes JMP 75b290c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe[1896] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075b816bd 2 bytes JMP 75b28891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075b81401 2 bytes JMP 75aab233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075b81419 2 bytes JMP 75aab35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075b81431 2 bytes JMP 75b29149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075b8144a 2 bytes CALL 75a84885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075b814dd 2 bytes JMP 75b28a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075b814f5 2 bytes JMP 75b28c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075b8150d 2 bytes JMP 75b28938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075b81525 2 bytes JMP 75b28d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075b8153d 2 bytes JMP 75a9fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075b81555 2 bytes JMP 75aa6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075b8156d 2 bytes JMP 75b29201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075b81585 2 bytes JMP 75b28d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075b8159d 2 bytes JMP 75b288fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075b815b5 2 bytes JMP 75a9fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075b815cd 2 bytes JMP 75aab2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075b816b2 2 bytes JMP 75b290c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Polar\WebSync\WebSync.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075b816bd 2 bytes JMP 75b28891 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075b81401 2 bytes JMP 75aab233 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075b81419 2 bytes JMP 75aab35e C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075b81431 2 bytes JMP 75b29149 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075b8144a 2 bytes CALL 75a84885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075b814dd 2 bytes JMP 75b28a42 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075b814f5 2 bytes JMP 75b28c18 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075b8150d 2 bytes JMP 75b28938 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075b81525 2 bytes JMP 75b28d02 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075b8153d 2 bytes JMP 75a9fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075b81555 2 bytes JMP 75aa6907 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075b8156d 2 bytes JMP 75b29201 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075b81585 2 bytes JMP 75b28d62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075b8159d 2 bytes JMP 75b288fc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075b815b5 2 bytes JMP 75a9fd59 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075b815cd 2 bytes JMP 75aab2f4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075b816b2 2 bytes JMP 75b290c4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4816] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075b816bd 2 bytes JMP 75b28891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3640] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770dbfb0 14 bytes {MOV RAX, 0x7feef1962b0; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000770dbe00 7 bytes [48, B8, 60, F9, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000770dbe08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000770dbf70 7 bytes [48, B8, E0, F9, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000770dbf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770dbf90 7 bytes [48, B8, D0, FD, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000770dbf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000770dbfa0 7 bytes [48, B8, C0, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000770dbfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770dbfb0 7 bytes [48, B8, 40, F8, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000770dbfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000770dbfd0 7 bytes [48, B8, B0, F8, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000770dbfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000770dc020 7 bytes [48, B8, 50, FA, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000770dc028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000770dc030 7 bytes [48, B8, 20, FE, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000770dc038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000770dc060 7 bytes [48, B8, 40, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000770dc068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000770dc100 7 bytes [48, B8, 80, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000770dc108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000770dc280 7 bytes [48, B8, C0, FA, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000770dc288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000770dccf0 7 bytes [48, B8, 00, FE, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000770dccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770dcd40 7 bytes [48, B8, A0, FD, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000770dcd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000770dce90 7 bytes [48, B8, A0, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1612] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000770dce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000770dbe00 7 bytes [48, B8, 60, F9, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000770dbe08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000770dbf70 7 bytes [48, B8, E0, F9, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000770dbf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770dbf90 7 bytes [48, B8, D0, FD, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000770dbf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000770dbfa0 7 bytes [48, B8, C0, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000770dbfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770dbfb0 7 bytes [48, B8, 40, F8, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000770dbfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000770dbfd0 7 bytes [48, B8, B0, F8, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000770dbfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000770dc020 7 bytes [48, B8, 50, FA, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000770dc028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000770dc030 7 bytes [48, B8, 20, FE, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000770dc038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000770dc060 7 bytes [48, B8, 40, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000770dc068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000770dc100 7 bytes [48, B8, 80, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000770dc108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000770dc280 7 bytes [48, B8, C0, FA, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000770dc288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000770dccf0 7 bytes [48, B8, 00, FE, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000770dccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770dcd40 7 bytes [48, B8, A0, FD, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000770dcd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000770dce90 7 bytes [48, B8, A0, FB, 1C, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000770dce98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee3c26490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee3c25ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee3c26470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee3c266e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4216] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2d62730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0014350013ed Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\38b1dbd53080 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\acd1b8e954b8 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\acd1b8e954b8@000780577a67 0xE0 0x70 0xF8 0xD9 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0014350013ed (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\38b1dbd53080 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\acd1b8e954b8 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\acd1b8e954b8@000780577a67 0xE0 0x70 0xF8 0xD9 ... ---- EOF - GMER 2.2 ----