2e44.2de0: Log file opened: 5.0.14r105127 g_hStartupLog=0000000000000058 g_uNtVerCombined=0xa037bb00 2e44.2de0: \SystemRoot\System32\ntdll.dll: 2e44.2de0: CreationTime: 2016-02-13T16:47:16.059499300Z 2e44.2de0: LastWriteTime: 2016-02-13T16:47:16.059499300Z 2e44.2de0: ChangeTime: 2016-02-23T14:01:55.270597700Z 2e44.2de0: FileAttributes: 0x20 2e44.2de0: Size: 0x1c4538 2e44.2de0: NT Headers: 0xd8 2e44.2de0: Timestamp: 0x56bf26dc 2e44.2de0: Machine: 0x8664 - amd64 2e44.2de0: Timestamp: 0x56bf26dc 2e44.2de0: Image Version: 10.0 2e44.2de0: SizeOfImage: 0x1ca000 (1875968) 2e44.2de0: Resource Dir: 0x162000 LB 0x66370 2e44.2de0: ProductName: Microsoft® Windows® Operating System 2e44.2de0: ProductVersion: 10.0.14267.1000 2e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213) 2e44.2de0: FileDescription: NT Layer DLL 2e44.2de0: \SystemRoot\System32\kernel32.dll: 2e44.2de0: CreationTime: 2016-02-13T16:46:59.043908100Z 2e44.2de0: LastWriteTime: 2016-02-13T16:46:59.043908100Z 2e44.2de0: ChangeTime: 2016-02-23T14:01:54.426796600Z 2e44.2de0: FileAttributes: 0x20 2e44.2de0: Size: 0xa9990 2e44.2de0: NT Headers: 0xf8 2e44.2de0: Timestamp: 0x56bf2799 2e44.2de0: Machine: 0x8664 - amd64 2e44.2de0: Timestamp: 0x56bf2799 2e44.2de0: Image Version: 10.0 2e44.2de0: SizeOfImage: 0xab000 (700416) 2e44.2de0: Resource Dir: 0xa9000 LB 0x528 2e44.2de0: ProductName: Microsoft® Windows® Operating System 2e44.2de0: ProductVersion: 10.0.14267.1000 2e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213) 2e44.2de0: FileDescription: Windows NT BASE API Client DLL 2e44.2de0: \SystemRoot\System32\KernelBase.dll: 2e44.2de0: CreationTime: 2016-02-13T16:47:16.184498700Z 2e44.2de0: LastWriteTime: 2016-02-13T16:47:16.184498700Z 2e44.2de0: ChangeTime: 2016-02-23T14:01:54.458048700Z 2e44.2de0: FileAttributes: 0x20 2e44.2de0: Size: 0x1f0d48 2e44.2de0: NT Headers: 0x100 2e44.2de0: Timestamp: 0x56bf2742 2e44.2de0: Machine: 0x8664 - amd64 2e44.2de0: Timestamp: 0x56bf2742 2e44.2de0: Image Version: 10.0 2e44.2de0: SizeOfImage: 0x1f3000 (2043904) 2e44.2de0: Resource Dir: 0x1db000 LB 0x540 2e44.2de0: ProductName: Microsoft® Windows® Operating System 2e44.2de0: ProductVersion: 10.0.14267.1000 2e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213) 2e44.2de0: FileDescription: Windows NT BASE API Client DLL 2e44.2de0: \SystemRoot\System32\apisetschema.dll: 2e44.2de0: CreationTime: 2016-02-13T16:47:09.278262500Z 2e44.2de0: LastWriteTime: 2016-02-13T16:47:09.278262500Z 2e44.2de0: ChangeTime: 2016-02-23T14:01:53.098591300Z 2e44.2de0: FileAttributes: 0x20 2e44.2de0: Size: 0x16910 2e44.2de0: NT Headers: 0xc0 2e44.2de0: Timestamp: 0x56bf2960 2e44.2de0: Machine: 0x8664 - amd64 2e44.2de0: Timestamp: 0x56bf2960 2e44.2de0: Image Version: 10.0 2e44.2de0: SizeOfImage: 0x18000 (98304) 2e44.2de0: Resource Dir: 0x17000 LB 0x400 2e44.2de0: ProductName: Microsoft® Windows® Operating System 2e44.2de0: ProductVersion: 10.0.14267.1000 2e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213) 2e44.2de0: FileDescription: ApiSet Schema DLL 2e44.2de0: NtOpenDirectoryObject failed on \Driver: 0xc0000022 2e44.2de0: supR3HardenedWinFindAdversaries: 0x800 2e44.2de0: \SystemRoot\System32\drivers\cfrmd.sys: 2e44.2de0: CreationTime: 2014-06-26T05:33:42.000000000Z 2e44.2de0: LastWriteTime: 2015-10-10T17:09:25.447875000Z 2e44.2de0: ChangeTime: 2016-02-23T14:12:44.741356400Z 2e44.2de0: FileAttributes: 0x20 2e44.2de0: Size: 0x9d20 2e44.2de0: NT Headers: 0xe8 2e44.2de0: Timestamp: 0x5004f2a1 2e44.2de0: Machine: 0x8664 - amd64 2e44.2de0: Timestamp: 0x5004f2a1 2e44.2de0: Image Version: 6.1 2e44.2de0: SizeOfImage: 0xe000 (57344) 2e44.2de0: Resource Dir: 0xc000 LB 0x3e0 2e44.2de0: ProductName: Windows (R) Win 7 DDK driver 2e44.2de0: ProductVersion: 6.1.7600.16385 2e44.2de0: FileVersion: 6.1.7600.16385 built by: WinDDK 2e44.2de0: FileDescription: Safe Deletion Driver 2e44.2de0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox' 2e44.2de0: Calling main() 2e44.2de0: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2 2e44.2de0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox' 2e44.2de0: SUPR3HardenedMain: Respawn #1 2e44.2de0: System32: \Device\HarddiskVolume6\Windows\System32 2e44.2de0: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS 2e44.2de0: KnownDllPath: C:\WINDOWS\system32 2e44.2de0: '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 2e44.2de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe) 2e44.2de0: supR3HardNtEnableThreadCreation: 2e44.2de0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc36fcb5a0 pvNtTerminateThread=00007ffc37041980 2e44.2de0: supR3HardenedWinDoReSpawn(1): New child 2d54.2c18 [kernel32]. 2e44.2de0: supR3HardNtChildGatherData: PebBaseAddress=00000000002cb000 cbPeb=0x388 2e44.2de0: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffc36fa0000 uNtDllChildAddr=00007ffc36fa0000 2e44.2de0: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffc36fcb5a0 2e44.2de0: supR3HardenedWinSetupChildInit: Start child. 2e44.2de0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms. 2e44.2de0: supR3HardNtChildPurify: Startup delay kludge #1/0: 515 ms, 59 sleeps 2e44.2de0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION 2e44.2de0: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000 2e44.2de0: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000 2e44.2de0: *0000000000030000-000000000001afff 0x0002/0x0002 0x0040000 2e44.2de0: 0000000000045000-0000000000039fff 0x0001/0x0000 0x0000000 2e44.2de0: *0000000000050000-fffffffffff53fff 0x0000/0x0004 0x0020000 2e44.2de0: 000000000014c000-0000000000148fff 0x0104/0x0004 0x0020000 2e44.2de0: 000000000014f000-000000000014dfff 0x0004/0x0004 0x0020000 2e44.2de0: *0000000000150000-000000000014bfff 0x0002/0x0002 0x0040000 2e44.2de0: 0000000000154000-0000000000147fff 0x0001/0x0000 0x0000000 2e44.2de0: *0000000000160000-000000000015dfff 0x0004/0x0004 0x0020000 2e44.2de0: 0000000000162000-00000000000c3fff 0x0001/0x0000 0x0000000 2e44.2de0: *0000000000200000-0000000000134fff 0x0000/0x0004 0x0020000 2e44.2de0: 00000000002cb000-00000000002c7fff 0x0004/0x0004 0x0020000 2e44.2de0: 00000000002ce000-000000000019bfff 0x0000/0x0004 0x0020000 2e44.2de0: 0000000000400000-ffffffff8081ffff 0x0001/0x0000 0x0000000 2e44.2de0: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000 2e44.2de0: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000 2e44.2de0: 000000007fff0000-ffff800a3b22ffff 0x0001/0x0000 0x0000000 2e44.2de0: *00007ff6c4db0000-00007ff6c4d7cfff 0x0002/0x0002 0x0040000 2e44.2de0: 00007ff6c4de3000-00007ff6c4395fff 0x0001/0x0000 0x0000000 2e44.2de0: *00007ff6c5830000-00007ff6c5830fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c5831000-00007ff6c58b7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c58b8000-00007ff6c58b8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c58b9000-00007ff6c5903fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c5904000-00007ff6c5904fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c5905000-00007ff6c5905fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c5906000-00007ff6c590afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c590b000-00007ff6c590bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c590c000-00007ff6c590cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c590d000-00007ff6c5910fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c5911000-00007ff6c595bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe 2e44.2de0: 00007ff6c595c000-00007ff154317fff 0x0001/0x0000 0x0000000 2e44.2de0: *00007ffc36fa0000-00007ffc36fa0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc36fa1000-00007ffc370a4fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc370a5000-00007ffc370e6fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc370e7000-00007ffc370effff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc370f0000-00007ffc370fdfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc370fe000-00007ffc370fefff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc370ff000-00007ffc37101fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc37102000-00007ffc37169fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll 2e44.2de0: 00007ffc3716a000-00007ff86e2f3fff 0x0001/0x0000 0x0000000 2e44.2de0: *00007ffffffe0000-00007ffffffcffff 0x0001/0x0002 0x0020000 2e44.2de0: VirtualBox.exe: timestamp 0x569e6712 (rc=VINF_SUCCESS) 2e44.2de0: '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 2e44.2de0: '\Device\HarddiskVolume6\Windows\System32\ntdll.dll' has no imports 2e44.2de0: supR3HardNtChildPurify: Done after 561 ms and 0 fixes (loop #0). 2e44.2de0: supR3HardNtEnableThreadCreation: 2d54.2c18: Log file opened: 5.0.14r105127 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa037bb00 2d54.2c18: supR3HardenedVmProcessInit: uNtDllAddr=00007ffc36fa0000 2d54.2c18: ntdll.dll: timestamp 0x56bf26dc (rc=VINF_SUCCESS) 2d54.2c18: New simple heap: #1 0000000000500000 LB 0x400000 (for 1875968 allocation) 2d54.2c18: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox' 2d54.2c18: System32: \Device\HarddiskVolume6\Windows\System32 2d54.2c18: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS 2d54.2c18: KnownDllPath: C:\WINDOWS\system32 2d54.2c18: supR3HardenedVmProcessInit: Opening vboxdrv stub... 2d54.2c18: supR3HardenedWinReadErrorInfoDevice: 'ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da' 2d54.2c18: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3) 2d54.2c18: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20) VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da 2e44.2de0: supR3HardenedWinCheckChild: enmRequest=2 rc=-5600 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20) VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da 2e44.2de0: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3) 2e44.2de0: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20) VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da