GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-08-28 20:04:10 Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500418AS rev.CC46 Running: nz1jbkrz.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uwrdakob.sys ---- System - GMER 1.0.15 ---- INT 0x52 ? 9E6767D8 INT 0x62 ? 9E676058 INT 0x72 ? 9E676558 INT 0x82 ? 9F3ADA58 INT 0x92 ? 9E676CD8 INT 0xA2 ? 9E6822D8 INT 0xB0 ? 9F3ADCD8 INT 0xB1 ? 9E682CD8 INT 0xB2 ? 9E682058 ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwSaveKeyEx + 13AD E307C579 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 E30A0F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .xreloc C:\Windows\System32\drivers\sfsync04.sys unknown last section [0xA52F9000, 0xC5E, 0x40000040] ---- User code sections - GMER 1.0.15 ---- .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtCreateFile + 6 77B44A16 4 Bytes [28, 00, 30, 00] {SUB [EAX], AL; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtCreateFile + B 77B44A1B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtMapViewOfSection + 6 77B45076 1 Byte [28] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtMapViewOfSection + 6 77B45076 4 Bytes [28, 03, 30, 00] {SUB [EBX], AL; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtMapViewOfSection + B 77B4507B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenFile + 6 77B45126 4 Bytes [68, 00, 30, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenFile + B 77B4512B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenProcess + 6 77B451D6 4 Bytes [A8, 01, 30, 00] {TEST AL, 0x1; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenProcess + B 77B451DB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenProcessToken + B 77B451EB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenProcessTokenEx + 6 77B451F6 4 Bytes [A8, 02, 30, 00] {TEST AL, 0x2; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenProcessTokenEx + B 77B451FB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenThread + 6 77B45256 4 Bytes [68, 01, 30, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenThread + B 77B4525B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenThreadToken + 6 77B45266 4 Bytes [68, 02, 30, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenThreadToken + B 77B4526B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtOpenThreadTokenEx + B 77B4527B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtQueryAttributesFile + 6 77B45386 4 Bytes [A8, 00, 30, 00] {TEST AL, 0x0; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtQueryAttributesFile + B 77B4538B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtQueryFullAttributesFile + B 77B4543B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtSetInformationFile + 6 77B45A86 4 Bytes [28, 01, 30, 00] {SUB [ECX], AL; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtSetInformationFile + B 77B45A8B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtSetInformationThread + 6 77B45AE6 4 Bytes [28, 02, 30, 00] {SUB [EDX], AL; XOR [EAX], AL} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtSetInformationThread + B 77B45AEB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 1 Byte [68] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 4 Bytes [68, 03, 30, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[776] ntdll.dll!NtUnmapViewOfSection + B 77B45E0B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtCreateFile + 6 77B44A16 4 Bytes [28, 00, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtCreateFile + B 77B44A1B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtMapViewOfSection + 6 77B45076 1 Byte [28] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtMapViewOfSection + 6 77B45076 4 Bytes [28, 03, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtMapViewOfSection + B 77B4507B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenFile + 6 77B45126 4 Bytes [68, 00, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenFile + B 77B4512B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenProcess + 6 77B451D6 4 Bytes [A8, 01, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenProcess + B 77B451DB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenProcessToken + B 77B451EB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenProcessTokenEx + 6 77B451F6 4 Bytes [A8, 02, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenProcessTokenEx + B 77B451FB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenThread + 6 77B45256 4 Bytes [68, 01, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenThread + B 77B4525B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenThreadToken + 6 77B45266 4 Bytes [68, 02, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenThreadToken + B 77B4526B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtOpenThreadTokenEx + B 77B4527B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtQueryAttributesFile + 6 77B45386 4 Bytes [A8, 00, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtQueryAttributesFile + B 77B4538B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtQueryFullAttributesFile + B 77B4543B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtSetInformationFile + 6 77B45A86 4 Bytes [28, 01, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtSetInformationFile + B 77B45A8B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtSetInformationThread + 6 77B45AE6 4 Bytes [28, 02, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtSetInformationThread + B 77B45AEB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 1 Byte [68] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 4 Bytes [68, 03, 26, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1052] ntdll.dll!NtUnmapViewOfSection + B 77B45E0B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtCreateFile + 6 77B44A16 4 Bytes [28, 00, 21, 00] {SUB [EAX], AL; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtCreateFile + B 77B44A1B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtMapViewOfSection + 6 77B45076 1 Byte [28] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtMapViewOfSection + 6 77B45076 4 Bytes [28, 03, 21, 00] {SUB [EBX], AL; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtMapViewOfSection + B 77B4507B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenFile + 6 77B45126 4 Bytes [68, 00, 21, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenFile + B 77B4512B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenProcess + 6 77B451D6 4 Bytes [A8, 01, 21, 00] {TEST AL, 0x1; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenProcess + B 77B451DB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenProcessToken + B 77B451EB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenProcessTokenEx + 6 77B451F6 4 Bytes [A8, 02, 21, 00] {TEST AL, 0x2; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenProcessTokenEx + B 77B451FB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenThread + 6 77B45256 4 Bytes [68, 01, 21, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenThread + B 77B4525B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenThreadToken + 6 77B45266 4 Bytes [68, 02, 21, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenThreadToken + B 77B4526B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtOpenThreadTokenEx + B 77B4527B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtQueryAttributesFile + 6 77B45386 4 Bytes [A8, 00, 21, 00] {TEST AL, 0x0; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtQueryAttributesFile + B 77B4538B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtQueryFullAttributesFile + B 77B4543B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtSetInformationFile + 6 77B45A86 4 Bytes [28, 01, 21, 00] {SUB [ECX], AL; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtSetInformationFile + B 77B45A8B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtSetInformationThread + 6 77B45AE6 4 Bytes [28, 02, 21, 00] {SUB [EDX], AL; AND [EAX], EAX} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtSetInformationThread + B 77B45AEB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 1 Byte [68] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 4 Bytes [68, 03, 21, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1780] ntdll.dll!NtUnmapViewOfSection + B 77B45E0B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtCreateFile + 6 77B44A16 4 Bytes [28, 00, 2B, 00] {SUB [EAX], AL; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtCreateFile + B 77B44A1B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtMapViewOfSection + 6 77B45076 1 Byte [28] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtMapViewOfSection + 6 77B45076 4 Bytes [28, 03, 2B, 00] {SUB [EBX], AL; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtMapViewOfSection + B 77B4507B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenFile + 6 77B45126 4 Bytes [68, 00, 2B, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenFile + B 77B4512B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenProcess + 6 77B451D6 4 Bytes [A8, 01, 2B, 00] {TEST AL, 0x1; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenProcess + B 77B451DB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenProcessToken + B 77B451EB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenProcessTokenEx + 6 77B451F6 4 Bytes [A8, 02, 2B, 00] {TEST AL, 0x2; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenProcessTokenEx + B 77B451FB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenThread + 6 77B45256 4 Bytes [68, 01, 2B, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenThread + B 77B4525B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenThreadToken + 6 77B45266 4 Bytes [68, 02, 2B, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenThreadToken + B 77B4526B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtOpenThreadTokenEx + B 77B4527B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtQueryAttributesFile + 6 77B45386 4 Bytes [A8, 00, 2B, 00] {TEST AL, 0x0; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtQueryAttributesFile + B 77B4538B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtQueryFullAttributesFile + B 77B4543B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtSetInformationFile + 6 77B45A86 4 Bytes [28, 01, 2B, 00] {SUB [ECX], AL; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtSetInformationFile + B 77B45A8B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtSetInformationThread + 6 77B45AE6 4 Bytes [28, 02, 2B, 00] {SUB [EDX], AL; SUB EAX, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtSetInformationThread + B 77B45AEB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 1 Byte [68] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 4 Bytes [68, 03, 2B, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[1816] ntdll.dll!NtUnmapViewOfSection + B 77B45E0B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtCreateFile + 6 77B44A16 4 Bytes [28, 00, 2A, 00] {SUB [EAX], AL; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtCreateFile + B 77B44A1B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtMapViewOfSection + 6 77B45076 1 Byte [28] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtMapViewOfSection + 6 77B45076 4 Bytes [28, 03, 2A, 00] {SUB [EBX], AL; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtMapViewOfSection + B 77B4507B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenFile + 6 77B45126 4 Bytes [68, 00, 2A, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenFile + B 77B4512B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenProcess + 6 77B451D6 4 Bytes [A8, 01, 2A, 00] {TEST AL, 0x1; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenProcess + B 77B451DB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenProcessToken + B 77B451EB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenProcessTokenEx + 6 77B451F6 4 Bytes [A8, 02, 2A, 00] {TEST AL, 0x2; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenProcessTokenEx + B 77B451FB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenThread + 6 77B45256 4 Bytes [68, 01, 2A, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenThread + B 77B4525B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenThreadToken + 6 77B45266 4 Bytes [68, 02, 2A, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenThreadToken + B 77B4526B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtOpenThreadTokenEx + B 77B4527B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtQueryAttributesFile + 6 77B45386 4 Bytes [A8, 00, 2A, 00] {TEST AL, 0x0; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtQueryAttributesFile + B 77B4538B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtQueryFullAttributesFile + B 77B4543B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtSetInformationFile + 6 77B45A86 4 Bytes [28, 01, 2A, 00] {SUB [ECX], AL; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtSetInformationFile + B 77B45A8B 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtSetInformationThread + 6 77B45AE6 4 Bytes [28, 02, 2A, 00] {SUB [EDX], AL; SUB AL, [EAX]} .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtSetInformationThread + B 77B45AEB 1 Byte [E2] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 1 Byte [68] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtUnmapViewOfSection + 6 77B45E06 4 Bytes [68, 03, 2A, 00] .text C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe[2064] ntdll.dll!NtUnmapViewOfSection + B 77B45E0B 1 Byte [E2] ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7471250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [74712494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [746F5624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [746F56E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [74708573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74704D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [747050CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [747051A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [747066D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [747082CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74708819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7470907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7470E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1532] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74704C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\00000096 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) ---- EOF - GMER 1.0.15 ----