Code:
Alles auswählen Aufklappen ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-01 16:25:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2 Intel___ rev.1.0. 931,52GB
Running: gmer_2.1.19163.exe; Driver: Q:\Temp\fxldqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2012] C:\Windows\syswow64\psapi.dll!
GetModuleInformation + 69 0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2012] C:\Windows\syswow64\psapi.dll!
GetModuleInformation + 155 0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text E:\Programme\RocketDock\RocketDock.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text E:\Programme\RocketDock\RocketDock.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322
000000006b8d1a22 2 bytes [8D, 6B]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496
000000006b8d1ad0 2 bytes [8D, 6B]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552
000000006b8d1b08 2 bytes [8D, 6B]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730
000000006b8d1bba 2 bytes [8D, 6B]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762
000000006b8d1bda 2 bytes [8D, 6B]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationProcess
000000007740fab8 5 bytes JMP 0000000107a64696
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!ExtTextOutW
0000000076798b7a 5 bytes JMP 0000000107a69c72
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!GetGlyphIndicesW
0000000076799963 5 bytes JMP 0000000107a6a0ff
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!TextOutW
000000007679d41c 5 bytes JMP 0000000107a6973e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!ExtTextOutA
000000007679dce4 5 bytes JMP 0000000107a69b8e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!TextOutA
000000007679eda3 5 bytes JMP 0000000107a69672
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\GDI32.dll!GetGlyphIndicesA
00000000767b8dbd 5 bytes JMP 0000000107a6a032
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!DrawTextExW
00000000768e149e 5 bytes JMP 0000000107a69aa7
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!DrawTextW
00000000768e25cf 5 bytes JMP 0000000107a698e5
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!DrawTextA
00000000768eaea1 5 bytes JMP 0000000107a6980a
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!DrawTextExA
00000000768eaed8 5 bytes JMP 0000000107a699c0
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!DialogBoxParamW
00000000768fcfca 5 bytes JMP 0000000107a684fb
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!SetClipboardData
0000000076918e57 1 byte JMP 0000000107a6955b
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\USER32.dll!SetClipboardData + 2
0000000076918e59 3 bytes {JMP 0xffffffff91150704}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!closesocket
0000000074d83918 5 bytes JMP 0000000107a694a1
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!getaddrinfo
0000000074d84296 5 bytes JMP 0000000107a68039
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!WSASend
0000000074d84406 5 bytes JMP 0000000107a69150
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW
0000000074d84889 5 bytes JMP 0000000107a68119
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!recv
0000000074d86b0e 5 bytes JMP 0000000107a6908e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!send
0000000074d86f01 5 bytes JMP 0000000107a68fd5
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!WSARecv
0000000074d87089 5 bytes JMP 0000000107a69224
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult
0000000074d87489 5 bytes JMP 0000000107a6936b
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!WSAAsyncGetHostByName
0000000074d9726a 5 bytes JMP 0000000107a6841c
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WS2_32.dll!gethostbyname
0000000074d97673 5 bytes JMP 0000000107a67f78
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\syswow64\WININET.dll!InternetCrackUrlW
0000000074c03059 5 bytes JMP 0000000107a6a3c5
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5
000000007740f991 7 bytes {MOV EDX, 0xcf8228; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5
000000007740fbd5 7 bytes {MOV EDX, 0xcf8268; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5
000000007740fc05 7 bytes {MOV EDX, 0xcf81a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5
000000007740fc1d 7 bytes {MOV EDX, 0xcf8128; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5
000000007740fc35 7 bytes {MOV EDX, 0xcf8328; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5
000000007740fc65 7 bytes {MOV EDX, 0xcf8368; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5
000000007740fce5 7 bytes {MOV EDX, 0xcf82e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5
000000007740fcfd 7 bytes {MOV EDX, 0xcf82a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5
000000007740fd49 7 bytes {MOV EDX, 0xcf8068; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5
000000007740fe41 7 bytes {MOV EDX, 0xcf80a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5
0000000077410099 7 bytes {MOV EDX, 0xcf8028; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5
00000000774110a5 7 bytes {MOV EDX, 0xcf81e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5
000000007741111d 7 bytes {MOV EDX, 0xcf8168; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile
+ 5 0000000077411321 7 bytes {MOV EDX, 0xcf80e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5
000000007740f991 7 bytes {MOV EDX, 0x6a9228; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5
000000007740fbd5 7 bytes {MOV EDX, 0x6a9268; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5
000000007740fc05 7 bytes {MOV EDX, 0x6a91a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5
000000007740fc1d 7 bytes {MOV EDX, 0x6a9128; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5
000000007740fc35 7 bytes {MOV EDX, 0x6a9328; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5
000000007740fc65 7 bytes {MOV EDX, 0x6a9368; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5
000000007740fce5 7 bytes {MOV EDX, 0x6a92e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5
000000007740fcfd 7 bytes {MOV EDX, 0x6a92a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5
000000007740fd49 7 bytes {MOV EDX, 0x6a9068; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5
000000007740fe41 7 bytes {MOV EDX, 0x6a90a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5
0000000077410099 7 bytes {MOV EDX, 0x6a9028; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5
00000000774110a5 7 bytes {MOV EDX, 0x6a91e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5
000000007741111d 7 bytes {MOV EDX, 0x6a9168; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile
+ 5 0000000077411321 7 bytes {MOV EDX, 0x6a90e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5
000000007740f991 7 bytes {MOV EDX, 0xa21a28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5
000000007740fbd5 7 bytes {MOV EDX, 0xa21a68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5
000000007740fc05 7 bytes {MOV EDX, 0xa219a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5
000000007740fc1d 7 bytes {MOV EDX, 0xa21928; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5
000000007740fc35 7 bytes {MOV EDX, 0xa21b28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5
000000007740fc65 7 bytes {MOV EDX, 0xa21b68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5
000000007740fce5 7 bytes {MOV EDX, 0xa21ae8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5
000000007740fcfd 7 bytes {MOV EDX, 0xa21aa8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5
000000007740fd49 7 bytes {MOV EDX, 0xa21868; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5
000000007740fe41 7 bytes {MOV EDX, 0xa218a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5
0000000077410099 7 bytes {MOV EDX, 0xa21828; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5
00000000774110a5 7 bytes {MOV EDX, 0xa219e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5
000000007741111d 7 bytes {MOV EDX, 0xa21968; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile
+ 5 0000000077411321 7 bytes {MOV EDX, 0xa218e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5
000000007740f991 7 bytes {MOV EDX, 0x405628; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5
000000007740fbd5 7 bytes {MOV EDX, 0x405668; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5
000000007740fc05 7 bytes {MOV EDX, 0x4055a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5
000000007740fc1d 7 bytes {MOV EDX, 0x405528; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5
000000007740fc35 7 bytes {MOV EDX, 0x405728; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5
000000007740fc65 7 bytes {MOV EDX, 0x405768; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5
000000007740fce5 7 bytes {MOV EDX, 0x4056e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5
000000007740fcfd 7 bytes {MOV EDX, 0x4056a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5
000000007740fd49 7 bytes {MOV EDX, 0x405468; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5
000000007740fe41 7 bytes {MOV EDX, 0x4054a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5
0000000077410099 7 bytes {MOV EDX, 0x405428; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5
00000000774110a5 7 bytes {MOV EDX, 0x4055e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5
000000007741111d 7 bytes {MOV EDX, 0x405568; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile
+ 5 0000000077411321 7 bytes {MOV EDX, 0x4054e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4560] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4560] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5
000000007740f991 7 bytes {MOV EDX, 0xddb228; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5
000000007740fbd5 7 bytes {MOV EDX, 0xddb268; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5
000000007740fc05 7 bytes {MOV EDX, 0xddb1a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5
000000007740fc1d 7 bytes {MOV EDX, 0xddb128; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5
000000007740fc35 7 bytes {MOV EDX, 0xddb328; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5
000000007740fc65 7 bytes {MOV EDX, 0xddb368; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5
000000007740fce5 7 bytes {MOV EDX, 0xddb2e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5
000000007740fcfd 7 bytes {MOV EDX, 0xddb2a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5
000000007740fd49 7 bytes {MOV EDX, 0xddb068; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5
000000007740fe41 7 bytes {MOV EDX, 0xddb0a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5
0000000077410099 7 bytes {MOV EDX, 0xddb028; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5
00000000774110a5 7 bytes {MOV EDX, 0xddb1e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5
000000007741111d 7 bytes {MOV EDX, 0xddb168; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile
+ 5 0000000077411321 7 bytes {MOV EDX, 0xddb0e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationProcess
000000007740fab8 5 bytes JMP 0000000102c84696
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!ExtTextOutW
0000000076798b7a 5 bytes JMP 0000000102c89c72
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!GetGlyphIndicesW
0000000076799963 5 bytes JMP 0000000102c8a0ff
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!TextOutW
000000007679d41c 5 bytes JMP 0000000102c8973e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!ExtTextOutA
000000007679dce4 5 bytes JMP 0000000102c89b8e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!TextOutA
000000007679eda3 5 bytes JMP 0000000102c89672
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\GDI32.dll!GetGlyphIndicesA
00000000767b8dbd 5 bytes JMP 0000000102c8a032
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!DrawTextExW
00000000768e149e 5 bytes JMP 0000000102c89aa7
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!DrawTextW
00000000768e25cf 5 bytes JMP 0000000102c898e5
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!DrawTextA
00000000768eaea1 5 bytes JMP 0000000102c8980a
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!DrawTextExA
00000000768eaed8 5 bytes JMP 0000000102c899c0
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!DialogBoxParamW
00000000768fcfca 5 bytes JMP 0000000102c884fb
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!SetClipboardData
0000000076918e57 1 byte JMP 0000000102c8955b
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\USER32.dll!SetClipboardData + 2
0000000076918e59 3 bytes {JMP 0xffffffff8c370704}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!closesocket
0000000074d83918 5 bytes JMP 0000000102c894a1
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!getaddrinfo
0000000074d84296 5 bytes JMP 0000000102c88039
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!WSASend
0000000074d84406 5 bytes JMP 0000000102c89150
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW
0000000074d84889 5 bytes JMP 0000000102c88119
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!recv
0000000074d86b0e 5 bytes JMP 0000000102c8908e
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!send
0000000074d86f01 5 bytes JMP 0000000102c88fd5
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!WSARecv
0000000074d87089 5 bytes JMP 0000000102c89224
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult
0000000074d87489 5 bytes JMP 0000000102c8936b
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!WSAAsyncGetHostByName
0000000074d9726a 5 bytes JMP 0000000102c8841c
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WS2_32.dll!gethostbyname
0000000074d97673 5 bytes JMP 0000000102c87f78
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5212] C:\Windows\syswow64\WININET.dll!InternetCrackUrlW
0000000074c03059 5 bytes JMP 0000000102c8a3c5
.text E:\Programme\DAEMON Tools Pro\DTShellHlp.exe[1880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text E:\Programme\DAEMON Tools Pro\DTShellHlp.exe[1880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
.text C:\Users\Nullinger\Downloads\gmer_2.1.19163.exe[5916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69
0000000074d11465 2 bytes [D1, 74]
.text C:\Users\Nullinger\Downloads\gmer_2.1.19163.exe[5916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155
0000000074d114bb 2 bytes [D1, 74]
.text ...
* 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\rundll32.exe [1760:1924]
0000000000300500
Thread C:\Windows\SysWOW64\rundll32.exe [1760:1928]
0000000000193a80
Thread C:\Windows\SysWOW64\rundll32.exe [1760:2040]
0000000000193a10
Thread C:\Windows\SysWOW64\rundll32.exe [1760:5392]
0000000000a196b7
Thread C:\Windows\SysWOW64\rundll32.exe [1760:5388]
0000000000a16874
Thread C:\Windows\SysWOW64\rundll32.exe [1760:5384]
0000000000a16dbc
---- EOF - GMER 2.1 ----