GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-09-22 18:03:16 Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545025B9A300 rev.PB2OC60N Running: io6muy7x.exe; Driver: C:\Users\Szymon\AppData\Local\Temp\ufdyqaow.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 820473C9 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82080D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- User code sections - GMER 1.0.15 ---- .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 0A, 00] {SUB [EAX], AL; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 0A, 00] {SUB [EBX], AL; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 0A, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 0A, 00] {TEST AL, 0x1; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 0A, 00] {TEST AL, 0x2; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 0A, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 0A, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 0A, 00] {TEST AL, 0x0; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 0A, 00] {SUB [ECX], AL; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 0A, 00] {SUB [EDX], AL; OR AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 0A, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[3484] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 09, 00] {SUB [EAX], AL; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 09, 00] {SUB [EBX], AL; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 09, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 09, 00] {TEST AL, 0x1; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 09, 00] {TEST AL, 0x2; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 09, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 09, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 09, 00] {TEST AL, 0x0; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 09, 00] {SUB [ECX], AL; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 09, 00] {SUB [EDX], AL; OR [EAX], EAX} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 09, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5056] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 2C, 00] {SUB [EAX], AL; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 2C, 00] {SUB [EBX], AL; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 2C, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 2C, 00] {TEST AL, 0x1; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 2C, 00] {TEST AL, 0x2; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 2C, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 2C, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 2C, 00] {TEST AL, 0x0; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 2C, 00] {SUB [ECX], AL; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 2C, 00] {SUB [EDX], AL; SUB AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 2C, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5172] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 24, 00] {SUB [EAX], AL; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 24, 00] {SUB [EBX], AL; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 24, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 24, 00] {TEST AL, 0x1; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 24, 00] {TEST AL, 0x2; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 24, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 24, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 24, 00] {TEST AL, 0x0; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 24, 00] {SUB [ECX], AL; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 24, 00] {SUB [EDX], AL; AND AL, 0x0} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 24, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5368] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 43, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5472] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 1D, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[5932] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 3B, 00] {SUB [EAX], AL; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 3B, 00] {SUB [EBX], AL; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 3B, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 3B, 00] {TEST AL, 0x1; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 3B, 00] {TEST AL, 0x2; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 3B, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 3B, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 3B, 00] {TEST AL, 0x0; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 3B, 00] {SUB [ECX], AL; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 3B, 00] {SUB [EDX], AL; CMP EAX, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 3B, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6016] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 22, 00] {SUB [EAX], AL; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 22, 00] {SUB [EBX], AL; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 22, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 22, 00] {TEST AL, 0x1; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 22, 00] {TEST AL, 0x2; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 22, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 22, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 22, 00] {TEST AL, 0x0; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 22, 00] {SUB [ECX], AL; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 22, 00] {SUB [EDX], AL; AND AL, [EAX]} .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 22, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6096] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtCreateFile + 6 77AD55CE 4 Bytes [28, 00, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtCreateFile + B 77AD55D3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 1 Byte [28] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtMapViewOfSection + 6 77AD5C2E 4 Bytes [28, 03, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtMapViewOfSection + B 77AD5C33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenFile + 6 77AD5CDE 4 Bytes [68, 00, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenFile + B 77AD5CE3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenProcess + 6 77AD5D8E 4 Bytes [A8, 01, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenProcess + B 77AD5D93 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenProcessToken + B 77AD5DA3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenProcessTokenEx + 6 77AD5DAE 4 Bytes [A8, 02, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenProcessTokenEx + B 77AD5DB3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenThread + 6 77AD5E0E 4 Bytes [68, 01, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenThread + B 77AD5E13 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenThreadToken + 6 77AD5E1E 4 Bytes [68, 02, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenThreadToken + B 77AD5E23 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtOpenThreadTokenEx + B 77AD5E33 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtQueryAttributesFile + 6 77AD5F3E 4 Bytes [A8, 00, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtQueryAttributesFile + B 77AD5F43 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtQueryFullAttributesFile + B 77AD5FF3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtSetInformationFile + 6 77AD663E 4 Bytes [28, 01, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtSetInformationFile + B 77AD6643 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtSetInformationThread + 6 77AD669E 4 Bytes [28, 02, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtSetInformationThread + B 77AD66A3 1 Byte [E2] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 1 Byte [68] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtUnmapViewOfSection + 6 77AD69BE 4 Bytes [68, 03, 35, 00] .text C:\Users\Szymon\AppData\Local\Google\Chrome\Application\chrome.exe[6104] ntdll.dll!NtUnmapViewOfSection + B 77AD69C3 1 Byte [E2] ---- Devices - GMER 1.0.15 ---- Device \Driver\ACPI_HAL \Device\00000051 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) Device \Driver\BTHUSB \Device\00000078 bthport.sys (Sterownik magistrali Bluetooth/Microsoft Corporation) AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Menedżer filtrów systemu plików firmy Microsoft/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c4bd6088c7e Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c4bd6088c7e (not active ControlSet) Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intel\xae Matrix Storage Manager\Intel\xae Matrix Storage Console.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\xae Matrix Storage Manager\Intel\xae Matrix Storage Console.lnk 1 ---- Files - GMER 1.0.15 ---- File C:\Windows\$NtUninstallKB24387$\2265241671 0 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\@ 2048 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\Desktop.ini 4608 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\L 0 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\L\00000004.@ 804 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\L\201d3dde 268 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\L\xadqgnnk 78336 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U 0 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U\00000004.@ 2048 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U\00000008.@ 232960 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U\000000cb.@ 1632 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U\80000000.@ 13312 bytes File C:\Windows\$NtUninstallKB24387$\2265241671\U\80000032.@ 91136 bytes File C:\Windows\$NtUninstallKB24387$\366225345 0 bytes ---- EOF - GMER 1.0.15 ----