GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-06-06 23:11:52 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK2552GSX rev.LV010A 232,89GB Running: lwtx01fu.exe; Driver: C:\Users\corvin\AppData\Local\Temp\pxdirpob.sys ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82E7AA09 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EB41F2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- User code sections - GMER 2.1 ---- .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, 38, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, 3B, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, 38, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, 39, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, 3A, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, 39, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, 3A, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, 38, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, 39, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, 3A, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, 3B, 67, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[980] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, 90, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, 93, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, 90, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, 91, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, 92, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, 91, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, 92, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, 90, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, 91, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, 92, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, 93, AA, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3308] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, 9C, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, 9F, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, 9C, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, 9D, 76, 00] {TEST AL, 0x9d; JBE 0x4} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, 9E, 76, 00] {TEST AL, 0x9e; JBE 0x4} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, 9D, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, 9E, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, 9C, 76, 00] {TEST AL, 0x9c; JBE 0x4} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, 9D, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, 9E, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, 9F, 76, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, B0, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, B3, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, B0, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, B1, 62, 00] {TEST AL, 0xb1; BOUND EAX, [EAX]} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, B2, 62, 00] {TEST AL, 0xb2; BOUND EAX, [EAX]} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, B1, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, B2, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, B0, 62, 00] {TEST AL, 0xb0; BOUND EAX, [EAX]} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, B1, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, B2, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, B3, 62, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3896] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, 60, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, 63, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, 60, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, 61, D3, 00] {TEST AL, 0x61; ROL [EAX], CL} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, 62, D3, 00] {TEST AL, 0x62; ROL [EAX], CL} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, 61, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, 62, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, 60, D3, 00] {TEST AL, 0x60; ROL [EAX], CL} .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, 61, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, 62, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, 63, D3, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3940] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtCreateFile + 6 776555CE 4 Bytes [28, 88, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtCreateFile + B 776555D3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtMapViewOfSection + 6 77655C2E 4 Bytes [28, 8B, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtMapViewOfSection + B 77655C33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenFile + 6 77655CDE 4 Bytes [68, 88, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenFile + B 77655CE3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenProcess + 6 77655D8E 4 Bytes [A8, 89, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenProcess + B 77655D93 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenProcessToken + B 77655DA3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenProcessTokenEx + 6 77655DAE 4 Bytes [A8, 8A, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenProcessTokenEx + B 77655DB3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenThread + 6 77655E0E 4 Bytes [68, 89, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenThread + B 77655E13 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenThreadToken + 6 77655E1E 4 Bytes [68, 8A, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenThreadToken + B 77655E23 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtOpenThreadTokenEx + B 77655E33 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtQueryAttributesFile + 6 77655F3E 4 Bytes [A8, 88, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtQueryAttributesFile + B 77655F43 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtQueryFullAttributesFile + B 77655FF3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtSetInformationFile + 6 7765663E 4 Bytes [28, 89, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtSetInformationFile + B 77656643 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtSetInformationThread + 6 7765669E 4 Bytes [28, 8A, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtSetInformationThread + B 776566A3 1 Byte [E2] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtUnmapViewOfSection + 6 776569BE 4 Bytes [68, 8B, 2D, 00] .text C:\Users\corvin\AppData\Local\Google\Chrome\Application\chrome.exe[3952] ntdll.dll!NtUnmapViewOfSection + B 776569C3 1 Byte [E2] ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [742C24CB] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [742A562E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [742A56EC] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [742C2546] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [742B85AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [742B4D5E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [742B5105] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [742B51DA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [742B6707] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [742B8301] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [742B8850] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [742B90B1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [742BE254] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll IAT C:\Windows\Explorer.EXE[1888] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [742B4C90] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll ---- EOF - GMER 2.1 ----