GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-04-17 23:23:37 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005d ST1000DX rev.CC41 931,51GB Running: 13kbdxxe.exe; Driver: C:\Users\Krzysiek\AppData\Local\Temp\pgddqpoc.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076941401 2 bytes JMP 76bcb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076941419 2 bytes JMP 76bcb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076941431 2 bytes JMP 76c49149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007694144a 2 bytes CALL 76ba4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769414dd 2 bytes JMP 76c48a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769414f5 2 bytes JMP 76c48c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007694150d 2 bytes JMP 76c48938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076941525 2 bytes JMP 76c48d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007694153d 2 bytes JMP 76bbfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076941555 2 bytes JMP 76bc6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007694156d 2 bytes JMP 76c49201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076941585 2 bytes JMP 76c48d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007694159d 2 bytes JMP 76c488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769415b5 2 bytes JMP 76bbfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769415cd 2 bytes JMP 76bcb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769416b2 2 bytes JMP 76c490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769416bd 2 bytes JMP 76c48891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4632] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007700bfb0 14 bytes {MOV RAX, 0x7fee81b64e0; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007700be00 7 bytes [48, B8, 60, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007700be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007700bf70 7 bytes [48, B8, E0, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007700bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007700bf90 7 bytes [48, B8, D0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007700bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007700bfa0 7 bytes [48, B8, C0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007700bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007700bfb0 7 bytes [48, B8, 40, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007700bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007700bfd0 7 bytes [48, B8, B0, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007700bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007700c020 7 bytes [48, B8, 50, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007700c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007700c030 7 bytes [48, B8, 20, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007700c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007700c060 7 bytes [48, B8, 40, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007700c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007700c100 7 bytes [48, B8, 80, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007700c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007700c280 7 bytes [48, B8, C0, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007700c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007700ccf0 7 bytes [48, B8, 00, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007700ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007700cd40 7 bytes [48, B8, A0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007700cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007700ce90 7 bytes [48, B8, A0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4496] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007700ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076941401 2 bytes JMP 76bcb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076941419 2 bytes JMP 76bcb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076941431 2 bytes JMP 76c49149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007694144a 2 bytes CALL 76ba4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769414dd 2 bytes JMP 76c48a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769414f5 2 bytes JMP 76c48c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007694150d 2 bytes JMP 76c48938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076941525 2 bytes JMP 76c48d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007694153d 2 bytes JMP 76bbfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076941555 2 bytes JMP 76bc6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007694156d 2 bytes JMP 76c49201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076941585 2 bytes JMP 76c48d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007694159d 2 bytes JMP 76c488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769415b5 2 bytes JMP 76bbfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769415cd 2 bytes JMP 76bcb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769416b2 2 bytes JMP 76c490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\Framework\Common\avguix.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769416bd 2 bytes JMP 76c48891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007700be00 7 bytes [48, B8, 60, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007700be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007700bf70 7 bytes [48, B8, E0, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007700bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007700bf90 7 bytes [48, B8, D0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007700bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007700bfa0 7 bytes [48, B8, C0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007700bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007700bfb0 7 bytes [48, B8, 40, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007700bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007700bfd0 7 bytes [48, B8, B0, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007700bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007700c020 7 bytes [48, B8, 50, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007700c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007700c030 7 bytes [48, B8, 20, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007700c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007700c060 7 bytes [48, B8, 40, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007700c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007700c100 7 bytes [48, B8, 80, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007700c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007700c280 7 bytes [48, B8, C0, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007700c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007700ccf0 7 bytes [48, B8, 00, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007700ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007700cd40 7 bytes [48, B8, A0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007700cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007700ce90 7 bytes [48, B8, A0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007700ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007700be00 7 bytes [48, B8, 60, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007700be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007700bf70 7 bytes [48, B8, E0, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007700bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007700bf90 7 bytes [48, B8, D0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007700bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007700bfa0 7 bytes [48, B8, C0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007700bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007700bfb0 7 bytes [48, B8, 40, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007700bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007700bfd0 7 bytes [48, B8, B0, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007700bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007700c020 7 bytes [48, B8, 50, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007700c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007700c030 7 bytes [48, B8, 20, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007700c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007700c060 7 bytes [48, B8, 40, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007700c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007700c100 7 bytes [48, B8, 80, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007700c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007700c280 7 bytes [48, B8, C0, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007700c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007700ccf0 7 bytes [48, B8, 00, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007700ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007700cd40 7 bytes [48, B8, A0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007700cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007700ce90 7 bytes [48, B8, A0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007700ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007700be00 7 bytes [48, B8, 60, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007700be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007700bf70 7 bytes [48, B8, E0, 0D, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007700bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007700bf90 7 bytes [48, B8, D0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007700bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007700bfa0 7 bytes [48, B8, C0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007700bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007700bfb0 7 bytes [48, B8, 40, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007700bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007700bfd0 7 bytes [48, B8, B0, 0C, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007700bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007700c020 7 bytes [48, B8, 50, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007700c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007700c030 7 bytes [48, B8, 20, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007700c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007700c060 7 bytes [48, B8, 40, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007700c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007700c100 7 bytes [48, B8, 80, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007700c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007700c280 7 bytes [48, B8, C0, 0E, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007700c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007700ccf0 7 bytes [48, B8, 00, 12, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007700ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007700cd40 7 bytes [48, B8, A0, 11, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007700cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007700ce90 7 bytes [48, B8, A0, 0F, 77, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007700ce98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee1c8e9c0] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee1c8e23c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee1c8e9a8] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee1c8ec08] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4556] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee0dcbd5c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee1c8e9c0] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee1c8e23c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee1c8e9a8] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee1c8ec08] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5896] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee0dcbd5c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee1c8e9c0] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee1c8e23c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee1c8e9a8] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee1c8ec08] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee0dcbd5c] C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5804] @ C:\Users\Krzysiek\AppData\Local\Google\Chrome\User Data\PepperFlash\25.0.0.148\pepflashplayer.dll[KERNEL32.dll!CreateNamedPipeW] [76ec002c] ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060d0819f Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060d0819f (not active ControlSet) ---- EOF - GMER 2.2 ----