VirtualBox

Ticket #13949: VBoxStartup.log

File VBoxStartup.log, 57.7 KB (added by buratin, 10 years ago)
Line 
12b2c.20e8: Log file opened: 4.3.24r98716 g_hStartupLog=0000000000000028 g_uNtVerCombined=0x611db110
22b2c.20e8: \SystemRoot\System32\ntdll.dll:
32b2c.20e8: CreationTime: 2013-11-15T07:43:29.515072300Z
42b2c.20e8: LastWriteTime: 2013-08-29T02:16:35.515578900Z
52b2c.20e8: ChangeTime: 2013-11-15T10:28:25.401792300Z
62b2c.20e8: FileAttributes: 0x20
72b2c.20e8: Size: 0x1a6dc0
82b2c.20e8: NT Headers: 0xe0
92b2c.20e8: Timestamp: 0x521eaf24
102b2c.20e8: Machine: 0x8664 - amd64
112b2c.20e8: Timestamp: 0x521eaf24
122b2c.20e8: Image Version: 6.1
132b2c.20e8: SizeOfImage: 0x1a9000 (1740800)
142b2c.20e8: Resource Dir: 0x151000 LB 0x560d8
152b2c.20e8: ProductName: Microsoft® Windows® Operating System
162b2c.20e8: ProductVersion: 6.1.7601.18247
172b2c.20e8: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
182b2c.20e8: FileDescription: NT Layer DLL
192b2c.20e8: \SystemRoot\System32\kernel32.dll:
202b2c.20e8: CreationTime: 2014-04-16T05:04:33.563177300Z
212b2c.20e8: LastWriteTime: 2014-03-04T09:44:00.336000000Z
222b2c.20e8: ChangeTime: 2014-04-16T05:24:46.753957400Z
232b2c.20e8: FileAttributes: 0x20
242b2c.20e8: Size: 0x11c000
252b2c.20e8: NT Headers: 0xe8
262b2c.20e8: Timestamp: 0x5315a059
272b2c.20e8: Machine: 0x8664 - amd64
282b2c.20e8: Timestamp: 0x5315a059
292b2c.20e8: Image Version: 6.1
302b2c.20e8: SizeOfImage: 0x11f000 (1175552)
312b2c.20e8: Resource Dir: 0x116000 LB 0x528
322b2c.20e8: ProductName: Microsoft® Windows® Operating System
332b2c.20e8: ProductVersion: 6.1.7601.18409
342b2c.20e8: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
352b2c.20e8: FileDescription: Windows NT BASE API Client DLL
362b2c.20e8: \SystemRoot\System32\KernelBase.dll:
372b2c.20e8: CreationTime: 2014-05-19T05:17:31.014644800Z
382b2c.20e8: LastWriteTime: 2014-03-04T09:44:00.336000000Z
392b2c.20e8: ChangeTime: 2014-05-19T05:32:40.719677400Z
402b2c.20e8: FileAttributes: 0x20
412b2c.20e8: Size: 0x67c00
422b2c.20e8: NT Headers: 0xe8
432b2c.20e8: Timestamp: 0x5315a05a
442b2c.20e8: Machine: 0x8664 - amd64
452b2c.20e8: Timestamp: 0x5315a05a
462b2c.20e8: Image Version: 6.1
472b2c.20e8: SizeOfImage: 0x6c000 (442368)
482b2c.20e8: Resource Dir: 0x6a000 LB 0x530
492b2c.20e8: ProductName: Microsoft® Windows® Operating System
502b2c.20e8: ProductVersion: 6.1.7601.18409
512b2c.20e8: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
522b2c.20e8: FileDescription: Windows NT BASE API Client DLL
532b2c.20e8: \SystemRoot\System32\apisetschema.dll:
542b2c.20e8: CreationTime: 2013-09-12T05:14:17.940756300Z
552b2c.20e8: LastWriteTime: 2013-08-02T02:12:20.275000000Z
562b2c.20e8: ChangeTime: 2013-09-12T05:45:38.834941500Z
572b2c.20e8: FileAttributes: 0x20
582b2c.20e8: Size: 0x1a00
592b2c.20e8: NT Headers: 0xc0
602b2c.20e8: Timestamp: 0x51fb15ca
612b2c.20e8: Machine: 0x8664 - amd64
622b2c.20e8: Timestamp: 0x51fb15ca
632b2c.20e8: Image Version: 6.1
642b2c.20e8: SizeOfImage: 0x50000 (327680)
652b2c.20e8: Resource Dir: 0x30000 LB 0x3f8
662b2c.20e8: ProductName: Microsoft® Windows® Operating System
672b2c.20e8: ProductVersion: 6.1.7601.18229
682b2c.20e8: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
692b2c.20e8: FileDescription: ApiSet Schema DLL
702b2c.20e8: Found driver SysPlant (0x1)
712b2c.20e8: Found driver SymNetS (0x2)
722b2c.20e8: Found driver SRTSPX (0x2)
732b2c.20e8: Found driver SymEvent (0x2)
742b2c.20e8: Found driver SymIRON (0x2)
752b2c.20e8: supR3HardenedWinFindAdversaries: 0x3
762b2c.20e8: \SystemRoot\System32\drivers\SysPlant.sys:
772b2c.20e8: CreationTime: 2015-02-12T15:13:16.924536700Z
782b2c.20e8: LastWriteTime: 2015-02-12T15:13:16.928536700Z
792b2c.20e8: ChangeTime: 2015-02-12T15:13:16.928536700Z
802b2c.20e8: FileAttributes: 0x20
812b2c.20e8: Size: 0x26f40
822b2c.20e8: NT Headers: 0x100
832b2c.20e8: Timestamp: 0x5413cb4e
842b2c.20e8: Machine: 0x8664 - amd64
852b2c.20e8: Timestamp: 0x5413cb4e
862b2c.20e8: Image Version: 5.0
872b2c.20e8: SizeOfImage: 0x2d000 (184320)
882b2c.20e8: Resource Dir: 0x2b000 LB 0x498
892b2c.20e8: ProductName: Symantec CMC Firewall
902b2c.20e8: ProductVersion: 12.1.5337.5000
912b2c.20e8: FileVersion: 12.1.5337.5000
922b2c.20e8: FileDescription: Symantec CMC Firewall SysPlant
932b2c.20e8: \SystemRoot\System32\sysfer.dll:
942b2c.20e8: CreationTime: 2015-02-12T15:13:16.788536700Z
952b2c.20e8: LastWriteTime: 2015-02-12T15:13:16.792536700Z
962b2c.20e8: ChangeTime: 2015-02-12T15:13:16.792536700Z
972b2c.20e8: FileAttributes: 0x20
982b2c.20e8: Size: 0x70f60
992b2c.20e8: NT Headers: 0xe8
1002b2c.20e8: Timestamp: 0x5413cb55
1012b2c.20e8: Machine: 0x8664 - amd64
1022b2c.20e8: Timestamp: 0x5413cb55
1032b2c.20e8: Image Version: 0.0
1042b2c.20e8: SizeOfImage: 0x88000 (557056)
1052b2c.20e8: Resource Dir: 0x86000 LB 0x630
1062b2c.20e8: ProductName: Symantec CMC Firewall
1072b2c.20e8: ProductVersion: 12.1.5337.5000
1082b2c.20e8: FileVersion: 12.1.5337.5000
1092b2c.20e8: FileDescription: Symantec CMC Firewall sysfer
1102b2c.20e8: \SystemRoot\System32\drivers\symevent64x86.sys:
1112b2c.20e8: CreationTime: 2015-02-12T15:17:09.408536700Z
1122b2c.20e8: LastWriteTime: 2015-02-12T15:17:09.057536700Z
1132b2c.20e8: ChangeTime: 2015-02-12T15:17:09.057536700Z
1142b2c.20e8: FileAttributes: 0x20
1152b2c.20e8: Size: 0x2b658
1162b2c.20e8: NT Headers: 0xe8
1172b2c.20e8: Timestamp: 0x51f32ff2
1182b2c.20e8: Machine: 0x8664 - amd64
1192b2c.20e8: Timestamp: 0x51f32ff2
1202b2c.20e8: Image Version: 6.0
1212b2c.20e8: SizeOfImage: 0x38000 (229376)
1222b2c.20e8: Resource Dir: 0x36000 LB 0x3c8
1232b2c.20e8: ProductName: SYMEVENT
1242b2c.20e8: ProductVersion: 12.9.5.2
1252b2c.20e8: FileVersion: 12.9.5.2
1262b2c.20e8: FileDescription: Symantec Event Library
1272b2c.20e8: Calling main()
1282b2c.20e8: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
1292b2c.20e8: SUPR3HardenedMain: Respawn #1
1302b2c.20e8: System32: \Device\HarddiskVolume2\Windows\System32
1312b2c.20e8: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
1322b2c.20e8: KnownDllPath: C:\Windows\system32
1332b2c.20e8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
1342b2c.20e8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
1352b2c.20e8: supR3HardNtEnableThreadCreation:
1362b2c.20e8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076d5c340 pvNtTerminateThread=0000000076d817e0
1372b2c.20e8: supR3HardenedWinDoReSpawn(1): New child 1b64.2a9c [kernel32].
1382b2c.20e8: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380
1392b2c.20e8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076d30000 uNtDllChildAddr=0000000076d30000
1402b2c.20e8: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076d5c340
1412b2c.20e8: supR3HardenedWinSetupChildInit: Start child.
1422b2c.20e8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 10 ms.
1432b2c.20e8: supR3HardNtChildPurify: Startup delay kludge #1/0: 513 ms, 64 sleeps
1442b2c.20e8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
1452b2c.20e8: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
1462b2c.20e8: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
1472b2c.20e8: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
1482b2c.20e8: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
1492b2c.20e8: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
1502b2c.20e8: 0000000000041000-fffffffffffe1fff 0x0001/0x0000 0x0000000
1512b2c.20e8: *00000000000a0000-fffffffffffa3fff 0x0000/0x0004 0x0020000
1522b2c.20e8: 000000000019c000-0000000000198fff 0x0104/0x0004 0x0020000
1532b2c.20e8: 000000000019f000-000000000019dfff 0x0004/0x0004 0x0020000
1542b2c.20e8: 00000000001a0000-ffffffff8960ffff 0x0001/0x0000 0x0000000
1552b2c.20e8: *0000000076d30000-0000000076d2efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1562b2c.20e8: 0000000076d31000-0000000076c2efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1572b2c.20e8: 0000000076e33000-0000000076e03fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1582b2c.20e8: 0000000076e62000-0000000076e59fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1592b2c.20e8: 0000000076e6a000-0000000076e68fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1602b2c.20e8: 0000000076e6b000-0000000076e67fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1612b2c.20e8: 0000000076e6e000-0000000076e02fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1622b2c.20e8: 0000000076ed9000-000000006edd1fff 0x0001/0x0000 0x0000000
1632b2c.20e8: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
1642b2c.20e8: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
1652b2c.20e8: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
1662b2c.20e8: 000000007fff0000-000000007ffcffff 0x0001/0x0000 0x0000000
1672b2c.20e8: *0000000080010000-000000008000efff 0x0040/0x0040 0x0020000 !!
1682b2c.20e8: supHardNtVpScanVirtualMemory: Freeing exec mem at 0000000080010000 (0000000080010000 LB 0x1000)
1692b2c.20e8: 0000000080011000-ffffffffc0431fff 0x0001/0x0000 0x0000000
1702b2c.20e8: *000000013fbf0000-000000013fbeefff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1712b2c.20e8: 000000013fbf1000-000000013fb6cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1722b2c.20e8: 000000013fc75000-000000013fc73fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1732b2c.20e8: 000000013fc76000-000000013fc38fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1742b2c.20e8: 000000013fcb3000-000000013fcb1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1752b2c.20e8: 000000013fcb4000-000000013fcb2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1762b2c.20e8: 000000013fcb5000-000000013fcb2fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1772b2c.20e8: 000000013fcb7000-000000013fcb5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1782b2c.20e8: 000000013fcb8000-000000013fcb6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1792b2c.20e8: 000000013fcb9000-000000013fcb4fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1802b2c.20e8: 000000013fcbd000-000000013fc83fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
1812b2c.20e8: 000000013fcf6000-000000013fcebfff 0x0001/0x0000 0x0000000
1822b2c.20e8: *000000013fd00000-000000013fcfefff 0x0040/0x0040 0x0020000 !!
1832b2c.20e8: supHardNtVpScanVirtualMemory: Freeing exec mem at 000000013fd00000 (000000013fd00000 LB 0x1000)
1842b2c.20e8: 000000013fd01000-00000000ffa01fff 0x0001/0x0000 0x0000000
1852b2c.20e8: *0000000180000000-000000017fffefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files (x86)\DeviceLock\DeviceLock Agent\DLDrvUserMode64.dll
1862b2c.20e8: supHardNtVpScanVirtualMemory: Unmapping image mem at 0000000180000000 (0000000180000000 LB 0x1000) - 'DLDrvUserMode64.dll'
1872b2c.20e8: 0000000180001000-000000017fff1fff 0x0001/0x0000 0x0000000
1882b2c.20e8: *0000000180010000-000000018000efff 0x0040/0x0040 0x0020000 !!
1892b2c.20e8: supHardNtVpScanVirtualMemory: Freeing exec mem at 0000000180010000 (0000000180010000 LB 0x1000)
1902b2c.20e8: 0000000180011000-fffff80400fd1fff 0x0001/0x0000 0x0000000
1912b2c.20e8: *000007feff050000-000007feff04efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
1922b2c.20e8: 000007feff051000-000007fdfe0f1fff 0x0001/0x0000 0x0000000
1932b2c.20e8: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
1942b2c.20e8: 000007fffffd3000-000007fffffc8fff 0x0001/0x0000 0x0000000
1952b2c.20e8: *000007fffffdd000-000007fffffdafff 0x0004/0x0004 0x0020000
1962b2c.20e8: *000007fffffdf000-000007fffffddfff 0x0004/0x0004 0x0020000
1972b2c.20e8: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
1982b2c.20e8: apisetschema.dll: timestamp 0x51fb15ca (rc=VINF_SUCCESS)
1992b2c.20e8: VirtualBox.exe: timestamp 0x54f47197 (rc=VINF_SUCCESS)
2002b2c.20e8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
2012b2c.20e8: VirtualBox.exe: Differences in section #0 (headers) between file and memory:
2022b2c.20e8: 000000013fbf016a / 0x000016a: 00 != 11
2032b2c.20e8: 000000013fbf016c / 0x000016c: 00 != cc
2042b2c.20e8: 000000013fbf016d / 0x000016d: 00 != 01
2052b2c.20e8: 000000013fbf01c0 / 0x00001c0: 00 != cc
2062b2c.20e8: 000000013fbf01c1 / 0x00001c1: 00 != 01
2072b2c.20e8: 000000013fbf01c2 / 0x00001c2: 00 != 11
2082b2c.20e8: 000000013fbf01c4 / 0x00001c4: 00 != 20
2092b2c.20e8: Restored 0x400 bytes of original file content at 000000013fbf0000
2102b2c.20e8: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
2112b2c.20e8: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
2122b2c.20e8: ntdll.dll: Differences in section #1 (.text) between file and memory:
2132b2c.20e8: 0000000076d48610 / 0x0018610: 48 != e9
2142b2c.20e8: 0000000076d48611 / 0x0018611: 89 != 68
2152b2c.20e8: 0000000076d48612 / 0x0018612: 54 != 7e
2162b2c.20e8: 0000000076d48613 / 0x0018613: 24 != 2c
2172b2c.20e8: 0000000076d48614 / 0x0018614: 10 != 09
2182b2c.20e8: Restored 0x2000 bytes of original file content at 0000000076d47000
2192b2c.20e8: ntdll.dll: Differences in section #1 (.text) between file and memory:
2202b2c.20e8: 0000000076d49580 / 0x0019580: ff != e9
2212b2c.20e8: 0000000076d49581 / 0x0019581: f5 != db
2222b2c.20e8: 0000000076d49582 / 0x0019582: 41 != 6d
2232b2c.20e8: 0000000076d49583 / 0x0019583: 54 != 2c
2242b2c.20e8: 0000000076d49584 / 0x0019584: 41 != 09
2252b2c.20e8: 0000000076d49585 / 0x0019585: 55 != 90
2262b2c.20e8: Restored 0x2000 bytes of original file content at 0000000076d49000
2272b2c.20e8: ntdll.dll: Differences in section #1 (.text) between file and memory:
2282b2c.20e8: 0000000076d57ac0 / 0x0027ac0: 48 != e9
2292b2c.20e8: 0000000076d57ac1 / 0x0027ac1: 89 != 62
2302b2c.20e8: 0000000076d57ac2 / 0x0027ac2: 5c != 8b
2312b2c.20e8: 0000000076d57ac3 / 0x0027ac3: 24 != 2b
2322b2c.20e8: 0000000076d57ac4 / 0x0027ac4: 10 != 09
2332b2c.20e8: Restored 0x2000 bytes of original file content at 0000000076d57000
2342b2c.20e8: ntdll.dll: Differences in section #1 (.text) between file and memory:
2352b2c.20e8: 0000000076d81222 / 0x0051222: 48 != e9
2362b2c.20e8: 0000000076d81223 / 0x0051223: 85 != e3
2372b2c.20e8: 0000000076d81224 / 0x0051224: c0 != f2
2382b2c.20e8: 0000000076d81225 / 0x0051225: 74 != 28
2392b2c.20e8: 0000000076d81226 / 0x0051226: 0f != 09
2402b2c.20e8: 0000000076d81430 / 0x0051430: 4c != e9
2412b2c.20e8: 0000000076d81431 / 0x0051431: 8b != 7b
2422b2c.20e8: 0000000076d81432 / 0x0051432: d1 != ed
2432b2c.20e8: 0000000076d81433 / 0x0051433: b8 != 28
2442b2c.20e8: 0000000076d81434 / 0x0051434: 15 != 09
2452b2c.20e8: 0000000076d81435 / 0x0051435: 00 != 90
2462b2c.20e8: 0000000076d81436 / 0x0051436: 00 != 90
2472b2c.20e8: 0000000076d81437 / 0x0051437: 00 != 90
2482b2c.20e8: 0000000076d81530 / 0x0051530: 4c != e9
2492b2c.20e8: 0000000076d81531 / 0x0051531: 8b != cb
2502b2c.20e8: 0000000076d81532 / 0x0051532: d1 != ea
2512b2c.20e8: 0000000076d81533 / 0x0051533: b8 != 28
2522b2c.20e8: 0000000076d81534 / 0x0051534: 25 != 09
2532b2c.20e8: 0000000076d81535 / 0x0051535: 00 != 90
2542b2c.20e8: 0000000076d81536 / 0x0051536: 00 != 90
2552b2c.20e8: 0000000076d81537 / 0x0051537: 00 != 90
2562b2c.20e8: 0000000076d81550 / 0x0051550: 4c != e9
2572b2c.20e8: 0000000076d81551 / 0x0051551: 8b != 7b
2582b2c.20e8: 0000000076d81552 / 0x0051552: d1 != ed
2592b2c.20e8: 0000000076d81553 / 0x0051553: b8 != 28
2602b2c.20e8: 0000000076d81554 / 0x0051554: 27 != 09
2612b2c.20e8: 0000000076d81555 / 0x0051555: 00 != 90
2622b2c.20e8: 0000000076d81556 / 0x0051556: 00 != 90
2632b2c.20e8: 0000000076d81557 / 0x0051557: 00 != 90
2642b2c.20e8: 0000000076d81650 / 0x0051650: 4c != e9
2652b2c.20e8: 0000000076d81651 / 0x0051651: 8b != eb
2662b2c.20e8: 0000000076d81652 / 0x0051652: d1 != eb
2672b2c.20e8: 0000000076d81653 / 0x0051653: b8 != 28
2682b2c.20e8: 0000000076d81654 / 0x0051654: 37 != 09
2692b2c.20e8: 0000000076d81655 / 0x0051655: 00 != 90
2702b2c.20e8: 0000000076d81656 / 0x0051656: 00 != 90
2712b2c.20e8: 0000000076d81657 / 0x0051657: 00 != 90
2722b2c.20e8: 0000000076d81750 / 0x0051750: 4c != e9
2732b2c.20e8: 0000000076d81751 / 0x0051751: 8b != 3b
2742b2c.20e8: 0000000076d81752 / 0x0051752: d1 != e9
2752b2c.20e8: 0000000076d81753 / 0x0051753: b8 != 28
2762b2c.20e8: 0000000076d81754 / 0x0051754: 47 != 09
2772b2c.20e8: 0000000076d81755 / 0x0051755: 00 != 90
2782b2c.20e8: 0000000076d81756 / 0x0051756: 00 != 90
2792b2c.20e8: 0000000076d81757 / 0x0051757: 00 != 90
2802b2c.20e8: 0000000076d817b0 / 0x00517b0: 4c != e9
2812b2c.20e8: 0000000076d817b1 / 0x00517b1: 8b != 6b
2822b2c.20e8: 0000000076d817b2 / 0x00517b2: d1 != e9
2832b2c.20e8: 0000000076d817b3 / 0x00517b3: b8 != 28
2842b2c.20e8: 0000000076d817b4 / 0x00517b4: 4d != 09
2852b2c.20e8: 0000000076d817b5 / 0x00517b5: 00 != 90
2862b2c.20e8: 0000000076d817b6 / 0x00517b6: 00 != 90
2872b2c.20e8: 0000000076d817b7 / 0x00517b7: 00 != 90
2882b2c.20e8: 0000000076d820a0 / 0x00520a0: 4c != e9
2892b2c.20e8: 0000000076d820a1 / 0x00520a1: 8b != f2
2902b2c.20e8: 0000000076d820a2 / 0x00520a2: d1 != e4
2912b2c.20e8: 0000000076d820a3 / 0x00520a3: b8 != 28
2922b2c.20e8: 0000000076d820a4 / 0x00520a4: dc != 09
2932b2c.20e8: 0000000076d820a5 / 0x00520a5: 00 != 90
2942b2c.20e8: 0000000076d820a6 / 0x00520a6: 00 != 90
2952b2c.20e8: 0000000076d820a7 / 0x00520a7: 00 != 90
2962b2c.20e8: Restored 0x2000 bytes of original file content at 0000000076d8034e
2972b2c.20e8: ntdll.dll: Differences in section #1 (.text) between file and memory:
2982b2c.20e8: 0000000076dfe030 / 0x00ce030: 48 != e9
2992b2c.20e8: 0000000076dfe031 / 0x00ce031: 81 != b9
3002b2c.20e8: 0000000076dfe032 / 0x00ce032: ec != 23
3012b2c.20e8: 0000000076dfe033 / 0x00ce033: 08 != 21
3022b2c.20e8: 0000000076dfe034 / 0x00ce034: 05 != 09
3032b2c.20e8: 0000000076dfe035 / 0x00ce035: 00 != 90
3042b2c.20e8: 0000000076dfe036 / 0x00ce036: 00 != 90
3052b2c.20e8: Restored 0x2000 bytes of original file content at 0000000076dfc34e
3062b2c.20e8: supR3HardNtChildPurify: cFixes=9 g_fSupAdversaries=0x3 cPatchCount=0
3072b2c.20e8: supR3HardNtChildPurify: Startup delay kludge #1/1: 520 ms, 65 sleeps
3082b2c.20e8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
3092b2c.20e8: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
3102b2c.20e8: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
3112b2c.20e8: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
3122b2c.20e8: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
3132b2c.20e8: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
3142b2c.20e8: 0000000000041000-fffffffffffe1fff 0x0001/0x0000 0x0000000
3152b2c.20e8: *00000000000a0000-fffffffffffa3fff 0x0000/0x0004 0x0020000
3162b2c.20e8: 000000000019c000-0000000000198fff 0x0104/0x0004 0x0020000
3172b2c.20e8: 000000000019f000-000000000019dfff 0x0004/0x0004 0x0020000
3182b2c.20e8: 00000000001a0000-ffffffff8960ffff 0x0001/0x0000 0x0000000
3192b2c.20e8: *0000000076d30000-0000000076d2efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3202b2c.20e8: 0000000076d31000-0000000076c2efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3212b2c.20e8: 0000000076e33000-0000000076e03fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3222b2c.20e8: 0000000076e62000-0000000076e59fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3232b2c.20e8: 0000000076e6a000-0000000076e68fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3242b2c.20e8: 0000000076e6b000-0000000076e69fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3252b2c.20e8: 0000000076e6c000-0000000076e69fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3262b2c.20e8: 0000000076e6e000-0000000076e02fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
3272b2c.20e8: 0000000076ed9000-000000006edd1fff 0x0001/0x0000 0x0000000
3282b2c.20e8: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
3292b2c.20e8: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
3302b2c.20e8: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
3312b2c.20e8: 000000007fff0000-ffffffffc03effff 0x0001/0x0000 0x0000000
3322b2c.20e8: *000000013fbf0000-000000013fbeefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3332b2c.20e8: 000000013fbf1000-000000013fb6cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3342b2c.20e8: 000000013fc75000-000000013fc73fff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3352b2c.20e8: 000000013fc76000-000000013fc38fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3362b2c.20e8: 000000013fcb3000-000000013fca8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3372b2c.20e8: 000000013fcbd000-000000013fc83fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
3382b2c.20e8: 000000013fcf6000-fffff8038099bfff 0x0001/0x0000 0x0000000
3392b2c.20e8: *000007feff050000-000007feff04efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
3402b2c.20e8: 000007feff051000-000007fdfe0f1fff 0x0001/0x0000 0x0000000
3412b2c.20e8: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
3422b2c.20e8: 000007fffffd3000-000007fffffc8fff 0x0001/0x0000 0x0000000
3432b2c.20e8: *000007fffffdd000-000007fffffdafff 0x0004/0x0004 0x0020000
3442b2c.20e8: *000007fffffdf000-000007fffffddfff 0x0004/0x0004 0x0020000
3452b2c.20e8: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
3462b2c.20e8: supR3HardNtChildPurify: Done after 1070 ms and 9 fixes (loop #1).
3472b2c.20e8: supR3HardNtEnableThreadCreation:
3481b64.2a9c: Log file opened: 4.3.24r98716 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110
3491b64.2a9c: supR3HardenedVmProcessInit: uNtDllAddr=0000000076d30000
3501b64.2a9c: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
3511b64.2a9c: New simple heap: #1 00000000002a0000 LB 0x400000 (for 1740800 allocation)
3521b64.2a9c: System32: \Device\HarddiskVolume2\Windows\System32
3531b64.2a9c: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
3541b64.2a9c: KnownDllPath: C:\Windows\system32
3551b64.2a9c: supR3HardenedVmProcessInit: Opening vboxdrv stub...
3561b64.2a9c: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
3571b64.2a9c: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
3581b64.2a9c: Registered Dll notification callback with NTDLL.
3591b64.2a9c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
3601b64.2a9c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
3611b64.2a9c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
3621b64.2a9c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
3631b64.2a9c: supR3HardenedDllNotificationCallback: load 0000000076b10000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
3641b64.2a9c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
3651b64.2a9c: supR3HardenedDllNotificationCallback: load 000007fefcb30000 LB 0x0006c000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
3661b64.2a9c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
3671b64.2a9c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
3681b64.2a9c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b10000 'C:\Windows\system32\kernel32.dll'
3691b64.2a9c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076d5c340 pvNtTerminateThread=0000000076d817e0
3702b2c.20e8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 39 ms.
3711b64.2a9c: \SystemRoot\System32\ntdll.dll:
3721b64.2a9c: CreationTime: 2013-11-15T07:43:29.515072300Z
3731b64.2a9c: LastWriteTime: 2013-08-29T02:16:35.515578900Z
3741b64.2a9c: ChangeTime: 2013-11-15T10:28:25.401792300Z
3751b64.2a9c: FileAttributes: 0x20
3761b64.2a9c: Size: 0x1a6dc0
3771b64.2a9c: NT Headers: 0xe0
3781b64.2a9c: Timestamp: 0x521eaf24
3791b64.2a9c: Machine: 0x8664 - amd64
3801b64.2a9c: Timestamp: 0x521eaf24
3811b64.2a9c: Image Version: 6.1
3821b64.2a9c: SizeOfImage: 0x1a9000 (1740800)
3831b64.2a9c: Resource Dir: 0x151000 LB 0x560d8
3841b64.2a9c: ProductName: Microsoft® Windows® Operating System
3851b64.2a9c: ProductVersion: 6.1.7601.18247
3861b64.2a9c: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
3871b64.2a9c: FileDescription: NT Layer DLL
3881b64.2a9c: \SystemRoot\System32\kernel32.dll:
3891b64.2a9c: CreationTime: 2014-04-16T05:04:33.563177300Z
3901b64.2a9c: LastWriteTime: 2014-03-04T09:44:00.336000000Z
3911b64.2a9c: ChangeTime: 2014-04-16T05:24:46.753957400Z
3921b64.2a9c: FileAttributes: 0x20
3931b64.2a9c: Size: 0x11c000
3941b64.2a9c: NT Headers: 0xe8
3951b64.2a9c: Timestamp: 0x5315a059
3961b64.2a9c: Machine: 0x8664 - amd64
3971b64.2a9c: Timestamp: 0x5315a059
3981b64.2a9c: Image Version: 6.1
3991b64.2a9c: SizeOfImage: 0x11f000 (1175552)
4001b64.2a9c: Resource Dir: 0x116000 LB 0x528
4011b64.2a9c: ProductName: Microsoft® Windows® Operating System
4021b64.2a9c: ProductVersion: 6.1.7601.18409
4031b64.2a9c: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
4041b64.2a9c: FileDescription: Windows NT BASE API Client DLL
4051b64.2a9c: \SystemRoot\System32\KernelBase.dll:
4061b64.2a9c: CreationTime: 2014-05-19T05:17:31.014644800Z
4071b64.2a9c: LastWriteTime: 2014-03-04T09:44:00.336000000Z
4081b64.2a9c: ChangeTime: 2014-05-19T05:32:40.719677400Z
4091b64.2a9c: FileAttributes: 0x20
4101b64.2a9c: Size: 0x67c00
4111b64.2a9c: NT Headers: 0xe8
4121b64.2a9c: Timestamp: 0x5315a05a
4131b64.2a9c: Machine: 0x8664 - amd64
4141b64.2a9c: Timestamp: 0x5315a05a
4151b64.2a9c: Image Version: 6.1
4161b64.2a9c: SizeOfImage: 0x6c000 (442368)
4171b64.2a9c: Resource Dir: 0x6a000 LB 0x530
4181b64.2a9c: ProductName: Microsoft® Windows® Operating System
4191b64.2a9c: ProductVersion: 6.1.7601.18409
4201b64.2a9c: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
4211b64.2a9c: FileDescription: Windows NT BASE API Client DLL
4221b64.2a9c: \SystemRoot\System32\apisetschema.dll:
4231b64.2a9c: CreationTime: 2013-09-12T05:14:17.940756300Z
4241b64.2a9c: LastWriteTime: 2013-08-02T02:12:20.275000000Z
4251b64.2a9c: ChangeTime: 2013-09-12T05:45:38.834941500Z
4261b64.2a9c: FileAttributes: 0x20
4271b64.2a9c: Size: 0x1a00
4281b64.2a9c: NT Headers: 0xc0
4291b64.2a9c: Timestamp: 0x51fb15ca
4301b64.2a9c: Machine: 0x8664 - amd64
4311b64.2a9c: Timestamp: 0x51fb15ca
4321b64.2a9c: Image Version: 6.1
4331b64.2a9c: SizeOfImage: 0x50000 (327680)
4341b64.2a9c: Resource Dir: 0x30000 LB 0x3f8
4351b64.2a9c: ProductName: Microsoft® Windows® Operating System
4361b64.2a9c: ProductVersion: 6.1.7601.18229
4371b64.2a9c: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
4381b64.2a9c: FileDescription: ApiSet Schema DLL
4391b64.2a9c: Found driver SysPlant (0x1)
4401b64.2a9c: Found driver SymNetS (0x2)
4411b64.2a9c: Found driver SRTSPX (0x2)
4421b64.2a9c: Found driver SymEvent (0x2)
4431b64.2a9c: Found driver SymIRON (0x2)
4441b64.2a9c: supR3HardenedWinFindAdversaries: 0x3
4451b64.2a9c: \SystemRoot\System32\drivers\SysPlant.sys:
4461b64.2a9c: CreationTime: 2015-02-12T15:13:16.924536700Z
4471b64.2a9c: LastWriteTime: 2015-02-12T15:13:16.928536700Z
4481b64.2a9c: ChangeTime: 2015-02-12T15:13:16.928536700Z
4491b64.2a9c: FileAttributes: 0x20
4501b64.2a9c: Size: 0x26f40
4511b64.2a9c: NT Headers: 0x100
4521b64.2a9c: Timestamp: 0x5413cb4e
4531b64.2a9c: Machine: 0x8664 - amd64
4541b64.2a9c: Timestamp: 0x5413cb4e
4551b64.2a9c: Image Version: 5.0
4561b64.2a9c: SizeOfImage: 0x2d000 (184320)
4571b64.2a9c: Resource Dir: 0x2b000 LB 0x498
4581b64.2a9c: ProductName: Symantec CMC Firewall
4591b64.2a9c: ProductVersion: 12.1.5337.5000
4601b64.2a9c: FileVersion: 12.1.5337.5000
4611b64.2a9c: FileDescription: Symantec CMC Firewall SysPlant
4621b64.2a9c: \SystemRoot\System32\sysfer.dll:
4631b64.2a9c: CreationTime: 2015-02-12T15:13:16.788536700Z
4641b64.2a9c: LastWriteTime: 2015-02-12T15:13:16.792536700Z
4651b64.2a9c: ChangeTime: 2015-02-12T15:13:16.792536700Z
4661b64.2a9c: FileAttributes: 0x20
4671b64.2a9c: Size: 0x70f60
4681b64.2a9c: NT Headers: 0xe8
4691b64.2a9c: Timestamp: 0x5413cb55
4701b64.2a9c: Machine: 0x8664 - amd64
4711b64.2a9c: Timestamp: 0x5413cb55
4721b64.2a9c: Image Version: 0.0
4731b64.2a9c: SizeOfImage: 0x88000 (557056)
4741b64.2a9c: Resource Dir: 0x86000 LB 0x630
4751b64.2a9c: ProductName: Symantec CMC Firewall
4761b64.2a9c: ProductVersion: 12.1.5337.5000
4771b64.2a9c: FileVersion: 12.1.5337.5000
4781b64.2a9c: FileDescription: Symantec CMC Firewall sysfer
4791b64.2a9c: \SystemRoot\System32\drivers\symevent64x86.sys:
4801b64.2a9c: CreationTime: 2015-02-12T15:17:09.408536700Z
4811b64.2a9c: LastWriteTime: 2015-02-12T15:17:09.057536700Z
4821b64.2a9c: ChangeTime: 2015-02-12T15:17:09.057536700Z
4831b64.2a9c: FileAttributes: 0x20
4841b64.2a9c: Size: 0x2b658
4851b64.2a9c: NT Headers: 0xe8
4861b64.2a9c: Timestamp: 0x51f32ff2
4871b64.2a9c: Machine: 0x8664 - amd64
4881b64.2a9c: Timestamp: 0x51f32ff2
4891b64.2a9c: Image Version: 6.0
4901b64.2a9c: SizeOfImage: 0x38000 (229376)
4911b64.2a9c: Resource Dir: 0x36000 LB 0x3c8
4921b64.2a9c: ProductName: SYMEVENT
4931b64.2a9c: ProductVersion: 12.9.5.2
4941b64.2a9c: FileVersion: 12.9.5.2
4951b64.2a9c: FileDescription: Symantec Event Library
4961b64.2a9c: Calling main()
4971b64.2a9c: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
4981b64.2a9c: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
4991b64.2a9c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
5001b64.2a9c: SUPR3HardenedMain: Respawn #2
5011b64.2a9c: supR3HardNtEnableThreadCreation:
5021b64.2a9c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
5031b64.2a9c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
5041b64.2a9c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
5051b64.2a9c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
5061b64.2a9c: supR3HardenedDllNotificationCallback: load 000007fefc8f0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
5071b64.2a9c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
5081b64.2a9c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc8f0000 'C:\Windows\system32\apphelp.dll'
5091b64.2a9c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076d5c340 pvNtTerminateThread=0000000076d817e0
5101b64.2a9c: supR3HardenedWinDoReSpawn(2): New child 2be8.2a50 [kernel32].
5111b64.2a9c: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd6000 cbPeb=0x380
5121b64.2a9c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076d30000 uNtDllChildAddr=0000000076d30000
5131b64.2a9c: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076d5c340
5141b64.2a9c: supR3HardenedWinSetupChildInit: Start child.
5151b64.2a9c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 10 ms.
5161b64.2a9c: supR3HardNtChildPurify: Startup delay kludge #1/0: 520 ms, 65 sleeps
5171b64.2a9c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
5181b64.2a9c: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
5191b64.2a9c: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
5201b64.2a9c: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
5211b64.2a9c: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
5221b64.2a9c: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
5231b64.2a9c: 0000000000041000-ffffffffffeb1fff 0x0001/0x0000 0x0000000
5241b64.2a9c: *00000000001d0000-00000000000d3fff 0x0000/0x0004 0x0020000
5251b64.2a9c: 00000000002cc000-00000000002c8fff 0x0104/0x0004 0x0020000
5261b64.2a9c: 00000000002cf000-00000000002cdfff 0x0004/0x0004 0x0020000
5271b64.2a9c: 00000000002d0000-ffffffff8986ffff 0x0001/0x0000 0x0000000
5281b64.2a9c: *0000000076d30000-0000000076d2efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5291b64.2a9c: 0000000076d31000-0000000076c2efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5301b64.2a9c: 0000000076e33000-0000000076e03fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5311b64.2a9c: 0000000076e62000-0000000076e59fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5321b64.2a9c: 0000000076e6a000-0000000076e68fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5331b64.2a9c: 0000000076e6b000-0000000076e67fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5341b64.2a9c: 0000000076e6e000-0000000076e02fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
5351b64.2a9c: 0000000076ed9000-000000006edd1fff 0x0001/0x0000 0x0000000
5361b64.2a9c: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
5371b64.2a9c: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
5381b64.2a9c: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
5391b64.2a9c: 000000007fff0000-000000007ffcffff 0x0001/0x0000 0x0000000
5401b64.2a9c: *0000000080010000-000000008000efff 0x0040/0x0040 0x0020000 !!
5411b64.2a9c: supHardNtVpScanVirtualMemory: Freeing exec mem at 0000000080010000 (0000000080010000 LB 0x1000)
5421b64.2a9c: 0000000080011000-ffffffffc0431fff 0x0001/0x0000 0x0000000
5431b64.2a9c: *000000013fbf0000-000000013fbeefff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5441b64.2a9c: 000000013fbf1000-000000013fb6cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5451b64.2a9c: 000000013fc75000-000000013fc73fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5461b64.2a9c: 000000013fc76000-000000013fc38fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5471b64.2a9c: 000000013fcb3000-000000013fcb1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5481b64.2a9c: 000000013fcb4000-000000013fcb2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5491b64.2a9c: 000000013fcb5000-000000013fcb2fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5501b64.2a9c: 000000013fcb7000-000000013fcb5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5511b64.2a9c: 000000013fcb8000-000000013fcb6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5521b64.2a9c: 000000013fcb9000-000000013fcb4fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5531b64.2a9c: 000000013fcbd000-000000013fc83fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
5541b64.2a9c: 000000013fcf6000-000000013fcebfff 0x0001/0x0000 0x0000000
5551b64.2a9c: *000000013fd00000-000000013fcfefff 0x0040/0x0040 0x0020000 !!
5561b64.2a9c: supHardNtVpScanVirtualMemory: Freeing exec mem at 000000013fd00000 (000000013fd00000 LB 0x1000)
5571b64.2a9c: 000000013fd01000-00000000ffa01fff 0x0001/0x0000 0x0000000
5581b64.2a9c: *0000000180000000-000000017fffefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files (x86)\DeviceLock\DeviceLock Agent\DLDrvUserMode64.dll
5591b64.2a9c: supHardNtVpScanVirtualMemory: Unmapping image mem at 0000000180000000 (0000000180000000 LB 0x1000) - 'DLDrvUserMode64.dll'
5601b64.2a9c: 0000000180001000-000000017fff1fff 0x0001/0x0000 0x0000000
5611b64.2a9c: *0000000180010000-000000018000efff 0x0040/0x0040 0x0020000 !!
5621b64.2a9c: supHardNtVpScanVirtualMemory: Freeing exec mem at 0000000180010000 (0000000180010000 LB 0x1000)
5631b64.2a9c: 0000000180011000-fffff80400fd1fff 0x0001/0x0000 0x0000000
5641b64.2a9c: *000007feff050000-000007feff04efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
5651b64.2a9c: 000007feff051000-000007fdfe0f1fff 0x0001/0x0000 0x0000000
5661b64.2a9c: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
5671b64.2a9c: 000007fffffd3000-000007fffffcffff 0x0001/0x0000 0x0000000
5681b64.2a9c: *000007fffffd6000-000007fffffd4fff 0x0004/0x0004 0x0020000
5691b64.2a9c: 000007fffffd7000-000007fffffcffff 0x0001/0x0000 0x0000000
5701b64.2a9c: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
5711b64.2a9c: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
5721b64.2a9c: apisetschema.dll: timestamp 0x51fb15ca (rc=VINF_SUCCESS)
5731b64.2a9c: VirtualBox.exe: timestamp 0x54f47197 (rc=VINF_SUCCESS)
5741b64.2a9c: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
5751b64.2a9c: VirtualBox.exe: Differences in section #0 (headers) between file and memory:
5761b64.2a9c: 000000013fbf016a / 0x000016a: 00 != 11
5771b64.2a9c: 000000013fbf016c / 0x000016c: 00 != cc
5781b64.2a9c: 000000013fbf016d / 0x000016d: 00 != 01
5791b64.2a9c: 000000013fbf01c0 / 0x00001c0: 00 != cc
5801b64.2a9c: 000000013fbf01c1 / 0x00001c1: 00 != 01
5811b64.2a9c: 000000013fbf01c2 / 0x00001c2: 00 != 11
5821b64.2a9c: 000000013fbf01c4 / 0x00001c4: 00 != 20
5831b64.2a9c: Restored 0x400 bytes of original file content at 000000013fbf0000
5841b64.2a9c: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
5851b64.2a9c: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
5861b64.2a9c: ntdll.dll: Differences in section #1 (.text) between file and memory:
5871b64.2a9c: 0000000076d48610 / 0x0018610: 48 != e9
5881b64.2a9c: 0000000076d48611 / 0x0018611: 89 != 68
5891b64.2a9c: 0000000076d48612 / 0x0018612: 54 != 7e
5901b64.2a9c: 0000000076d48613 / 0x0018613: 24 != 2c
5911b64.2a9c: 0000000076d48614 / 0x0018614: 10 != 09
5921b64.2a9c: Restored 0x2000 bytes of original file content at 0000000076d47000
5931b64.2a9c: ntdll.dll: Differences in section #1 (.text) between file and memory:
5941b64.2a9c: 0000000076d49580 / 0x0019580: ff != e9
5951b64.2a9c: 0000000076d49581 / 0x0019581: f5 != db
5961b64.2a9c: 0000000076d49582 / 0x0019582: 41 != 6d
5971b64.2a9c: 0000000076d49583 / 0x0019583: 54 != 2c
5981b64.2a9c: 0000000076d49584 / 0x0019584: 41 != 09
5991b64.2a9c: 0000000076d49585 / 0x0019585: 55 != 90
6001b64.2a9c: Restored 0x2000 bytes of original file content at 0000000076d49000
6011b64.2a9c: ntdll.dll: Differences in section #1 (.text) between file and memory:
6021b64.2a9c: 0000000076d57ac0 / 0x0027ac0: 48 != e9
6031b64.2a9c: 0000000076d57ac1 / 0x0027ac1: 89 != 62
6041b64.2a9c: 0000000076d57ac2 / 0x0027ac2: 5c != 8b
6051b64.2a9c: 0000000076d57ac3 / 0x0027ac3: 24 != 2b
6061b64.2a9c: 0000000076d57ac4 / 0x0027ac4: 10 != 09
6071b64.2a9c: Restored 0x2000 bytes of original file content at 0000000076d57000
6081b64.2a9c: ntdll.dll: Differences in section #1 (.text) between file and memory:
6091b64.2a9c: 0000000076d81222 / 0x0051222: 48 != e9
6101b64.2a9c: 0000000076d81223 / 0x0051223: 85 != e3
6111b64.2a9c: 0000000076d81224 / 0x0051224: c0 != f2
6121b64.2a9c: 0000000076d81225 / 0x0051225: 74 != 28
6131b64.2a9c: 0000000076d81226 / 0x0051226: 0f != 09
6141b64.2a9c: 0000000076d81430 / 0x0051430: 4c != e9
6151b64.2a9c: 0000000076d81431 / 0x0051431: 8b != 7b
6161b64.2a9c: 0000000076d81432 / 0x0051432: d1 != ed
6171b64.2a9c: 0000000076d81433 / 0x0051433: b8 != 28
6181b64.2a9c: 0000000076d81434 / 0x0051434: 15 != 09
6191b64.2a9c: 0000000076d81435 / 0x0051435: 00 != 90
6201b64.2a9c: 0000000076d81436 / 0x0051436: 00 != 90
6211b64.2a9c: 0000000076d81437 / 0x0051437: 00 != 90
6221b64.2a9c: 0000000076d81530 / 0x0051530: 4c != e9
6231b64.2a9c: 0000000076d81531 / 0x0051531: 8b != cb
6241b64.2a9c: 0000000076d81532 / 0x0051532: d1 != ea
6251b64.2a9c: 0000000076d81533 / 0x0051533: b8 != 28
6261b64.2a9c: 0000000076d81534 / 0x0051534: 25 != 09
6271b64.2a9c: 0000000076d81535 / 0x0051535: 00 != 90
6281b64.2a9c: 0000000076d81536 / 0x0051536: 00 != 90
6291b64.2a9c: 0000000076d81537 / 0x0051537: 00 != 90
6301b64.2a9c: 0000000076d81550 / 0x0051550: 4c != e9
6311b64.2a9c: 0000000076d81551 / 0x0051551: 8b != 7b
6321b64.2a9c: 0000000076d81552 / 0x0051552: d1 != ed
6331b64.2a9c: 0000000076d81553 / 0x0051553: b8 != 28
6341b64.2a9c: 0000000076d81554 / 0x0051554: 27 != 09
6351b64.2a9c: 0000000076d81555 / 0x0051555: 00 != 90
6361b64.2a9c: 0000000076d81556 / 0x0051556: 00 != 90
6371b64.2a9c: 0000000076d81557 / 0x0051557: 00 != 90
6381b64.2a9c: 0000000076d81650 / 0x0051650: 4c != e9
6391b64.2a9c: 0000000076d81651 / 0x0051651: 8b != eb
6401b64.2a9c: 0000000076d81652 / 0x0051652: d1 != eb
6411b64.2a9c: 0000000076d81653 / 0x0051653: b8 != 28
6421b64.2a9c: 0000000076d81654 / 0x0051654: 37 != 09
6431b64.2a9c: 0000000076d81655 / 0x0051655: 00 != 90
6441b64.2a9c: 0000000076d81656 / 0x0051656: 00 != 90
6451b64.2a9c: 0000000076d81657 / 0x0051657: 00 != 90
6461b64.2a9c: 0000000076d81750 / 0x0051750: 4c != e9
6471b64.2a9c: 0000000076d81751 / 0x0051751: 8b != 3b
6481b64.2a9c: 0000000076d81752 / 0x0051752: d1 != e9
6491b64.2a9c: 0000000076d81753 / 0x0051753: b8 != 28
6501b64.2a9c: 0000000076d81754 / 0x0051754: 47 != 09
6511b64.2a9c: 0000000076d81755 / 0x0051755: 00 != 90
6521b64.2a9c: 0000000076d81756 / 0x0051756: 00 != 90
6531b64.2a9c: 0000000076d81757 / 0x0051757: 00 != 90
6541b64.2a9c: 0000000076d817b0 / 0x00517b0: 4c != e9
6551b64.2a9c: 0000000076d817b1 / 0x00517b1: 8b != 6b
6561b64.2a9c: 0000000076d817b2 / 0x00517b2: d1 != e9
6571b64.2a9c: 0000000076d817b3 / 0x00517b3: b8 != 28
6581b64.2a9c: 0000000076d817b4 / 0x00517b4: 4d != 09
6591b64.2a9c: 0000000076d817b5 / 0x00517b5: 00 != 90
6601b64.2a9c: 0000000076d817b6 / 0x00517b6: 00 != 90
6611b64.2a9c: 0000000076d817b7 / 0x00517b7: 00 != 90
6621b64.2a9c: 0000000076d820a0 / 0x00520a0: 4c != e9
6631b64.2a9c: 0000000076d820a1 / 0x00520a1: 8b != f2
6641b64.2a9c: 0000000076d820a2 / 0x00520a2: d1 != e4
6651b64.2a9c: 0000000076d820a3 / 0x00520a3: b8 != 28
6661b64.2a9c: 0000000076d820a4 / 0x00520a4: dc != 09
6671b64.2a9c: 0000000076d820a5 / 0x00520a5: 00 != 90
6681b64.2a9c: 0000000076d820a6 / 0x00520a6: 00 != 90
6691b64.2a9c: 0000000076d820a7 / 0x00520a7: 00 != 90
6701b64.2a9c: Restored 0x2000 bytes of original file content at 0000000076d8034e
6711b64.2a9c: ntdll.dll: Differences in section #1 (.text) between file and memory:
6721b64.2a9c: 0000000076dfe030 / 0x00ce030: 48 != e9
6731b64.2a9c: 0000000076dfe031 / 0x00ce031: 81 != b9
6741b64.2a9c: 0000000076dfe032 / 0x00ce032: ec != 23
6751b64.2a9c: 0000000076dfe033 / 0x00ce033: 08 != 21
6761b64.2a9c: 0000000076dfe034 / 0x00ce034: 05 != 09
6771b64.2a9c: 0000000076dfe035 / 0x00ce035: 00 != 90
6781b64.2a9c: 0000000076dfe036 / 0x00ce036: 00 != 90
6791b64.2a9c: Restored 0x2000 bytes of original file content at 0000000076dfc34e
6801b64.2a9c: supR3HardNtChildPurify: cFixes=9 g_fSupAdversaries=0x3 cPatchCount=0
6811b64.2a9c: supR3HardNtChildPurify: Startup delay kludge #1/1: 520 ms, 65 sleeps
6821b64.2a9c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
6831b64.2a9c: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
6841b64.2a9c: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
6851b64.2a9c: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
6861b64.2a9c: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
6871b64.2a9c: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
6881b64.2a9c: 0000000000041000-ffffffffffeb1fff 0x0001/0x0000 0x0000000
6891b64.2a9c: *00000000001d0000-00000000000d3fff 0x0000/0x0004 0x0020000
6901b64.2a9c: 00000000002cc000-00000000002c8fff 0x0104/0x0004 0x0020000
6911b64.2a9c: 00000000002cf000-00000000002cdfff 0x0004/0x0004 0x0020000
6921b64.2a9c: 00000000002d0000-ffffffff8986ffff 0x0001/0x0000 0x0000000
6931b64.2a9c: *0000000076d30000-0000000076d2efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6941b64.2a9c: 0000000076d31000-0000000076c2efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6951b64.2a9c: 0000000076e33000-0000000076e03fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6961b64.2a9c: 0000000076e62000-0000000076e59fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6971b64.2a9c: 0000000076e6a000-0000000076e68fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6981b64.2a9c: 0000000076e6b000-0000000076e69fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6991b64.2a9c: 0000000076e6c000-0000000076e69fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
7001b64.2a9c: 0000000076e6e000-0000000076e02fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
7011b64.2a9c: 0000000076ed9000-000000006edd1fff 0x0001/0x0000 0x0000000
7021b64.2a9c: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
7031b64.2a9c: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
7041b64.2a9c: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
7051b64.2a9c: 000000007fff0000-ffffffffc03effff 0x0001/0x0000 0x0000000
7061b64.2a9c: *000000013fbf0000-000000013fbeefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7071b64.2a9c: 000000013fbf1000-000000013fb6cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7081b64.2a9c: 000000013fc75000-000000013fc73fff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7091b64.2a9c: 000000013fc76000-000000013fc38fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7101b64.2a9c: 000000013fcb3000-000000013fca8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7111b64.2a9c: 000000013fcbd000-000000013fc83fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
7121b64.2a9c: 000000013fcf6000-fffff8038099bfff 0x0001/0x0000 0x0000000
7131b64.2a9c: *000007feff050000-000007feff04efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
7141b64.2a9c: 000007feff051000-000007fdfe0f1fff 0x0001/0x0000 0x0000000
7151b64.2a9c: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
7161b64.2a9c: 000007fffffd3000-000007fffffcffff 0x0001/0x0000 0x0000000
7171b64.2a9c: *000007fffffd6000-000007fffffd4fff 0x0004/0x0004 0x0020000
7181b64.2a9c: 000007fffffd7000-000007fffffcffff 0x0001/0x0000 0x0000000
7191b64.2a9c: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
7201b64.2a9c: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
7211b64.2a9c: supR3HardNtChildPurify: Done after 1080 ms and 9 fixes (loop #1).
7221b64.2a9c: supR3HardenedEarlyCompact: Removed heap 1 (0x000000002a0000 LB 0x400000)
7231b64.2a9c: supR3HardNtEnableThreadCreation:
7242be8.2a50: Log file opened: 4.3.24r98716 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110
7252be8.2a50: supR3HardenedVmProcessInit: uNtDllAddr=0000000076d30000
7262be8.2a50: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
7272be8.2a50: New simple heap: #1 00000000002d0000 LB 0x400000 (for 1740800 allocation)
7282be8.2a50: System32: \Device\HarddiskVolume2\Windows\System32
7292be8.2a50: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
7302be8.2a50: KnownDllPath: C:\Windows\system32
7312be8.2a50: supR3HardenedVmProcessInit: Opening vboxdrv...
7322be8.2a50: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
7332be8.2a50: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
7342be8.2a50: Registered Dll notification callback with NTDLL.
7352be8.2a50: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
7362be8.2a50: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
7372be8.2a50: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
7382be8.2a50: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
7392be8.2a50: supR3HardenedDllNotificationCallback: load 0000000076b10000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
7402be8.2a50: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
7412be8.2a50: supR3HardenedDllNotificationCallback: load 000007fefcb30000 LB 0x0006c000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
7422be8.2a50: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
7432be8.2a50: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
7442be8.2a50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b10000 'C:\Windows\system32\kernel32.dll'
7452be8.2a50: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076d5c340 pvNtTerminateThread=0000000076d817e0
7461b64.2a9c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 49 ms.
7472be8.2a50: \SystemRoot\System32\ntdll.dll:
7482be8.2a50: CreationTime: 2013-11-15T07:43:29.515072300Z
7492be8.2a50: LastWriteTime: 2013-08-29T02:16:35.515578900Z
7502be8.2a50: ChangeTime: 2013-11-15T10:28:25.401792300Z
7512be8.2a50: FileAttributes: 0x20
7522be8.2a50: Size: 0x1a6dc0
7532be8.2a50: NT Headers: 0xe0
7542be8.2a50: Timestamp: 0x521eaf24
7552be8.2a50: Machine: 0x8664 - amd64
7562be8.2a50: Timestamp: 0x521eaf24
7572be8.2a50: Image Version: 6.1
7582be8.2a50: SizeOfImage: 0x1a9000 (1740800)
7592be8.2a50: Resource Dir: 0x151000 LB 0x560d8
7602be8.2a50: ProductName: Microsoft® Windows® Operating System
7612be8.2a50: ProductVersion: 6.1.7601.18247
7622be8.2a50: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
7632be8.2a50: FileDescription: NT Layer DLL
7642be8.2a50: \SystemRoot\System32\kernel32.dll:
7652be8.2a50: CreationTime: 2014-04-16T05:04:33.563177300Z
7662be8.2a50: LastWriteTime: 2014-03-04T09:44:00.336000000Z
7672be8.2a50: ChangeTime: 2014-04-16T05:24:46.753957400Z
7682be8.2a50: FileAttributes: 0x20
7692be8.2a50: Size: 0x11c000
7702be8.2a50: NT Headers: 0xe8
7712be8.2a50: Timestamp: 0x5315a059
7722be8.2a50: Machine: 0x8664 - amd64
7732be8.2a50: Timestamp: 0x5315a059
7742be8.2a50: Image Version: 6.1
7752be8.2a50: SizeOfImage: 0x11f000 (1175552)
7762be8.2a50: Resource Dir: 0x116000 LB 0x528
7772be8.2a50: ProductName: Microsoft® Windows® Operating System
7782be8.2a50: ProductVersion: 6.1.7601.18409
7792be8.2a50: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
7802be8.2a50: FileDescription: Windows NT BASE API Client DLL
7812be8.2a50: \SystemRoot\System32\KernelBase.dll:
7822be8.2a50: CreationTime: 2014-05-19T05:17:31.014644800Z
7832be8.2a50: LastWriteTime: 2014-03-04T09:44:00.336000000Z
7842be8.2a50: ChangeTime: 2014-05-19T05:32:40.719677400Z
7852be8.2a50: FileAttributes: 0x20
7862be8.2a50: Size: 0x67c00
7872be8.2a50: NT Headers: 0xe8
7882be8.2a50: Timestamp: 0x5315a05a
7892be8.2a50: Machine: 0x8664 - amd64
7902be8.2a50: Timestamp: 0x5315a05a
7912be8.2a50: Image Version: 6.1
7922be8.2a50: SizeOfImage: 0x6c000 (442368)
7932be8.2a50: Resource Dir: 0x6a000 LB 0x530
7942be8.2a50: ProductName: Microsoft® Windows® Operating System
7952be8.2a50: ProductVersion: 6.1.7601.18409
7962be8.2a50: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
7972be8.2a50: FileDescription: Windows NT BASE API Client DLL
7982be8.2a50: \SystemRoot\System32\apisetschema.dll:
7992be8.2a50: CreationTime: 2013-09-12T05:14:17.940756300Z
8002be8.2a50: LastWriteTime: 2013-08-02T02:12:20.275000000Z
8012be8.2a50: ChangeTime: 2013-09-12T05:45:38.834941500Z
8022be8.2a50: FileAttributes: 0x20
8032be8.2a50: Size: 0x1a00
8042be8.2a50: NT Headers: 0xc0
8052be8.2a50: Timestamp: 0x51fb15ca
8062be8.2a50: Machine: 0x8664 - amd64
8072be8.2a50: Timestamp: 0x51fb15ca
8082be8.2a50: Image Version: 6.1
8092be8.2a50: SizeOfImage: 0x50000 (327680)
8102be8.2a50: Resource Dir: 0x30000 LB 0x3f8
8112be8.2a50: ProductName: Microsoft® Windows® Operating System
8122be8.2a50: ProductVersion: 6.1.7601.18229
8132be8.2a50: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
8142be8.2a50: FileDescription: ApiSet Schema DLL
8152be8.2a50: Found driver SysPlant (0x1)
8162be8.2a50: Found driver SymNetS (0x2)
8172be8.2a50: Found driver SRTSPX (0x2)
8182be8.2a50: Found driver SymEvent (0x2)
8192be8.2a50: Found driver SymIRON (0x2)
8202be8.2a50: supR3HardenedWinFindAdversaries: 0x3
8212be8.2a50: \SystemRoot\System32\drivers\SysPlant.sys:
8222be8.2a50: CreationTime: 2015-02-12T15:13:16.924536700Z
8232be8.2a50: LastWriteTime: 2015-02-12T15:13:16.928536700Z
8242be8.2a50: ChangeTime: 2015-02-12T15:13:16.928536700Z
8252be8.2a50: FileAttributes: 0x20
8262be8.2a50: Size: 0x26f40
8272be8.2a50: NT Headers: 0x100
8282be8.2a50: Timestamp: 0x5413cb4e
8292be8.2a50: Machine: 0x8664 - amd64
8302be8.2a50: Timestamp: 0x5413cb4e
8312be8.2a50: Image Version: 5.0
8322be8.2a50: SizeOfImage: 0x2d000 (184320)
8332be8.2a50: Resource Dir: 0x2b000 LB 0x498
8342be8.2a50: ProductName: Symantec CMC Firewall
8352be8.2a50: ProductVersion: 12.1.5337.5000
8362be8.2a50: FileVersion: 12.1.5337.5000
8372be8.2a50: FileDescription: Symantec CMC Firewall SysPlant
8382be8.2a50: \SystemRoot\System32\sysfer.dll:
8392be8.2a50: CreationTime: 2015-02-12T15:13:16.788536700Z
8402be8.2a50: LastWriteTime: 2015-02-12T15:13:16.792536700Z
8412be8.2a50: ChangeTime: 2015-02-12T15:13:16.792536700Z
8422be8.2a50: FileAttributes: 0x20
8432be8.2a50: Size: 0x70f60
8442be8.2a50: NT Headers: 0xe8
8452be8.2a50: Timestamp: 0x5413cb55
8462be8.2a50: Machine: 0x8664 - amd64
8472be8.2a50: Timestamp: 0x5413cb55
8482be8.2a50: Image Version: 0.0
8492be8.2a50: SizeOfImage: 0x88000 (557056)
8502be8.2a50: Resource Dir: 0x86000 LB 0x630
8512be8.2a50: ProductName: Symantec CMC Firewall
8522be8.2a50: ProductVersion: 12.1.5337.5000
8532be8.2a50: FileVersion: 12.1.5337.5000
8542be8.2a50: FileDescription: Symantec CMC Firewall sysfer
8552be8.2a50: \SystemRoot\System32\drivers\symevent64x86.sys:
8562be8.2a50: CreationTime: 2015-02-12T15:17:09.408536700Z
8572be8.2a50: LastWriteTime: 2015-02-12T15:17:09.057536700Z
8582be8.2a50: ChangeTime: 2015-02-12T15:17:09.057536700Z
8592be8.2a50: FileAttributes: 0x20
8602be8.2a50: Size: 0x2b658
8612be8.2a50: NT Headers: 0xe8
8622be8.2a50: Timestamp: 0x51f32ff2
8632be8.2a50: Machine: 0x8664 - amd64
8642be8.2a50: Timestamp: 0x51f32ff2
8652be8.2a50: Image Version: 6.0
8662be8.2a50: SizeOfImage: 0x38000 (229376)
8672be8.2a50: Resource Dir: 0x36000 LB 0x3c8
8682be8.2a50: ProductName: SYMEVENT
8692be8.2a50: ProductVersion: 12.9.5.2
8702be8.2a50: FileVersion: 12.9.5.2
8712be8.2a50: FileDescription: Symantec Event Library
8722be8.2a50: Calling main()
8732be8.2a50: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
8742be8.2a50: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
8752be8.2a50: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
8762be8.2a50: SUPR3HardenedMain: Final process, opening VBoxDrv...
8772be8.2a50: supR3HardenedEarlyCompact: Removed heap 1 (0x000000002d0000 LB 0x400000)
8782be8.2a50: supR3HardNtEnableThreadCreation:
8792be8.2a50: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
8802be8.2a50: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
8812be8.2a50: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
8822be8.2a50: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
8832be8.2a50: supR3HardenedDllNotificationCallback: load 000007fefc8f0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
8842be8.2a50: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
8852be8.2a50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc8f0000 'C:\Windows\system32\apphelp.dll'
8861b64.2a9c: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1886 ms, the end);
8872b2c.20e8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 3041 ms, the end);

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette