10f0.644: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110 10f0.644: \SystemRoot\System32\ntdll.dll: 10f0.644: CreationTime: 2016-02-10T01:51:21.167950400Z 10f0.644: LastWriteTime: 2016-01-22T06:24:12.217581500Z 10f0.644: ChangeTime: 2016-02-14T17:13:12.062989500Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x1a73d8 10f0.644: NT Headers: 0xe0 10f0.644: Timestamp: 0x56a1c9c5 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56a1c9c5 10f0.644: Image Version: 6.1 10f0.644: SizeOfImage: 0x1aa000 (1744896) 10f0.644: Resource Dir: 0x14e000 LB 0x5a028 10f0.644: ProductName: Microsoft® Windows® Operating System 10f0.644: ProductVersion: 6.1.7601.19135 10f0.644: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 10f0.644: FileDescription: NT Layer DLL 10f0.644: \SystemRoot\System32\kernel32.dll: 10f0.644: CreationTime: 2016-02-10T01:51:19.351937500Z 10f0.644: LastWriteTime: 2016-01-22T06:15:31.619000000Z 10f0.644: ChangeTime: 2016-02-14T17:13:12.312590000Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x11c000 10f0.644: NT Headers: 0xe8 10f0.644: Timestamp: 0x56a1c9ab 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56a1c9ab 10f0.644: Image Version: 6.1 10f0.644: SizeOfImage: 0x11f000 (1175552) 10f0.644: Resource Dir: 0x116000 LB 0x528 10f0.644: ProductName: Microsoft® Windows® Operating System 10f0.644: ProductVersion: 6.1.7601.19135 10f0.644: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 10f0.644: FileDescription: Windows NT BASE API Client DLL 10f0.644: \SystemRoot\System32\KernelBase.dll: 10f0.644: CreationTime: 2016-02-10T01:51:20.807947700Z 10f0.644: LastWriteTime: 2016-01-22T06:15:31.822000000Z 10f0.644: ChangeTime: 2016-02-14T17:13:12.312590000Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x67200 10f0.644: NT Headers: 0xe8 10f0.644: Timestamp: 0x56a1c9ac 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56a1c9ac 10f0.644: Image Version: 6.1 10f0.644: SizeOfImage: 0x6b000 (438272) 10f0.644: Resource Dir: 0x69000 LB 0x530 10f0.644: ProductName: Microsoft® Windows® Operating System 10f0.644: ProductVersion: 6.1.7601.19135 10f0.644: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 10f0.644: FileDescription: Windows NT BASE API Client DLL 10f0.644: \SystemRoot\System32\apisetschema.dll: 10f0.644: CreationTime: 2016-02-10T01:51:11.224886700Z 10f0.644: LastWriteTime: 2016-01-22T06:12:25.181000000Z 10f0.644: ChangeTime: 2016-02-14T17:13:12.016189500Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x1a00 10f0.644: NT Headers: 0xc0 10f0.644: Timestamp: 0x56a1c890 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56a1c890 10f0.644: Image Version: 6.1 10f0.644: SizeOfImage: 0x50000 (327680) 10f0.644: Resource Dir: 0x30000 LB 0x3f8 10f0.644: ProductName: Microsoft® Windows® Operating System 10f0.644: ProductVersion: 6.1.7601.19135 10f0.644: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 10f0.644: FileDescription: ApiSet Schema DLL 10f0.644: NtOpenDirectoryObject failed on \Driver: 0xc0000022 10f0.644: supR3HardenedWinFindAdversaries: 0x400 10f0.644: \SystemRoot\System32\drivers\MpFilter.sys: 10f0.644: CreationTime: 2015-11-13T07:50:26.000000000Z 10f0.644: LastWriteTime: 2015-11-13T07:50:26.000000000Z 10f0.644: ChangeTime: 2016-02-25T15:20:53.247049600Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x46960 10f0.644: NT Headers: 0xe8 10f0.644: Timestamp: 0x56330e4f 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56330e4f 10f0.644: Image Version: 6.3 10f0.644: SizeOfImage: 0x44000 (278528) 10f0.644: Resource Dir: 0x42000 LB 0xd90 10f0.644: ProductName: Microsoft Malware Protection 10f0.644: ProductVersion: 4.9.0210.0 10f0.644: FileVersion: 4.9.0210.0 10f0.644: FileDescription: Microsoft antimalware file system filter driver 10f0.644: \SystemRoot\System32\drivers\NisDrvWFP.sys: 10f0.644: CreationTime: 2015-03-04T16:34:52.000000000Z 10f0.644: LastWriteTime: 2015-11-13T07:50:26.000000000Z 10f0.644: ChangeTime: 2016-02-25T15:20:52.217447700Z 10f0.644: FileAttributes: 0x20 10f0.644: Size: 0x20ab8 10f0.644: NT Headers: 0xe0 10f0.644: Timestamp: 0x56330e8a 10f0.644: Machine: 0x8664 - amd64 10f0.644: Timestamp: 0x56330e8a 10f0.644: Image Version: 6.3 10f0.644: SizeOfImage: 0x1f000 (126976) 10f0.644: Resource Dir: 0x1c000 LB 0x1b90 10f0.644: ProductName: Microsoft Malware Protection 10f0.644: ProductVersion: 4.9.0210.0 10f0.644: FileVersion: 4.9.0210.0 10f0.644: FileDescription: Microsoft Network Realtime Inspection Driver 10f0.644: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 10f0.644: Calling main() 10f0.644: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2 10f0.644: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 10f0.644: SUPR3HardenedMain: Respawn #1 10f0.644: System32: \Device\HarddiskVolume4\Windows\System32 10f0.644: WinSxS: \Device\HarddiskVolume4\Windows\winsxs 10f0.644: KnownDllPath: C:\Windows\system32 10f0.644: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 10f0.644: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe) 10f0.644: supR3HardNtEnableThreadCreation: 10f0.644: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007778b170 pvNtTerminateThread=00000000777ad8e0 10f0.644: supR3HardenedWinDoReSpawn(1): New child f48.1750 [kernel32]. 10f0.644: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd9000 cbPeb=0x380 10f0.644: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077760000 uNtDllChildAddr=0000000077760000 10f0.644: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007778b170 10f0.644: supR3HardenedWinSetupChildInit: Start child. 10f0.644: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 50 ms. 10f0.644: supR3HardNtChildPurify: Startup delay kludge #1/0: 522 ms, 63 sleeps 10f0.644: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION 10f0.644: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000 10f0.644: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000 10f0.644: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000 10f0.644: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000 10f0.644: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000 10f0.644: 0000000000041000-fffffffffff41fff 0x0001/0x0000 0x0000000 10f0.644: *0000000000140000-0000000000043fff 0x0000/0x0004 0x0020000 10f0.644: 000000000023c000-0000000000238fff 0x0104/0x0004 0x0020000 10f0.644: 000000000023f000-000000000023dfff 0x0004/0x0004 0x0020000 10f0.644: 0000000000240000-ffffffff88d1ffff 0x0001/0x0000 0x0000000 10f0.644: *0000000077760000-0000000077760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 0000000077761000-000000007785ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 0000000077860000-000000007788efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 000000007788f000-0000000077896fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 0000000077897000-0000000077897fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 0000000077898000-000000007789afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 000000007789b000-0000000077909fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 10f0.644: 000000007790a000-0000000070233fff 0x0001/0x0000 0x0000000 10f0.644: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000 10f0.644: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000 10f0.644: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000 10f0.644: 000000007fff0000-ffffffffc0deffff 0x0001/0x0000 0x0000000 10f0.644: *000000013f1f0000-000000013f1f0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f1f1000-000000013f277fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f278000-000000013f278fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f279000-000000013f2c3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2c4000-000000013f2c4fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2c5000-000000013f2c5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2c6000-000000013f2cafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2cb000-000000013f2cbfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2cc000-000000013f2ccfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2cd000-000000013f2d0fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f2d1000-000000013f31bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 10f0.644: 000000013f31c000-fffff8037ebb7fff 0x0001/0x0000 0x0000000 10f0.644: *000007feffa80000-000007feffa80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\apisetschema.dll 10f0.644: 000007feffa81000-000007fdff551fff 0x0001/0x0000 0x0000000 10f0.644: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000 10f0.644: 000007fffffd3000-000007fffffccfff 0x0001/0x0000 0x0000000 10f0.644: *000007fffffd9000-000007fffffd7fff 0x0004/0x0004 0x0020000 10f0.644: 000007fffffda000-000007fffffd5fff 0x0001/0x0000 0x0000000 10f0.644: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000 10f0.644: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000 10f0.644: apisetschema.dll: timestamp 0x56a1c890 (rc=VINF_SUCCESS) 10f0.644: VirtualBox.exe: timestamp 0x56d9b7eb (rc=VINF_SUCCESS) 10f0.644: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 10f0.644: '\Device\HarddiskVolume4\Windows\System32\apisetschema.dll' has no imports 10f0.644: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports 10f0.644: supR3HardNtChildPurify: Done after 552 ms and 0 fixes (loop #0). f48.1750: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100 f48.1750: supR3HardenedVmProcessInit: uNtDllAddr=0000000077760000 g_uNtVerCombined=0x611db100 f48.1750: ntdll.dll: timestamp 0x56a1c9c5 (rc=VINF_SUCCESS) f48.1750: New simple heap: #1 0000000000340000 LB 0x400000 (for 1744896 allocation) 10f0.644: supR3HardNtEnableThreadCreation: f48.1750: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' f48.1750: System32: \Device\HarddiskVolume4\Windows\System32 f48.1750: WinSxS: \Device\HarddiskVolume4\Windows\winsxs f48.1750: KnownDllPath: C:\Windows\system32 f48.1750: supR3HardenedVmProcessInit: Opening vboxdrv stub... f48.1750: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk... f48.1750: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk... f48.1750: Registered Dll notification callback with NTDLL. f48.1750: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll) f48.1750: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll f48.1750: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000: [calling] f48.1750: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust] 10f0.644: Error (rc=258): 10f0.644: Timed out after 60010 ms waiting for child request #1 (CloseEvents). 10f0.644: Error 258 in supR3HardNtChildWaitFor! (enmWhat=5) 10f0.644: Timed out after 60010 ms waiting for child request #1 (CloseEvents). 724.11c4: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110 724.11c4: \SystemRoot\System32\ntdll.dll: 724.11c4: CreationTime: 2016-02-10T01:51:21.167950400Z 724.11c4: LastWriteTime: 2016-01-22T06:24:12.217581500Z 724.11c4: ChangeTime: 2016-02-14T17:13:12.062989500Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x1a73d8 724.11c4: NT Headers: 0xe0 724.11c4: Timestamp: 0x56a1c9c5 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56a1c9c5 724.11c4: Image Version: 6.1 724.11c4: SizeOfImage: 0x1aa000 (1744896) 724.11c4: Resource Dir: 0x14e000 LB 0x5a028 724.11c4: ProductName: Microsoft® Windows® Operating System 724.11c4: ProductVersion: 6.1.7601.19135 724.11c4: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 724.11c4: FileDescription: NT Layer DLL 724.11c4: \SystemRoot\System32\kernel32.dll: 724.11c4: CreationTime: 2016-02-10T01:51:19.351937500Z 724.11c4: LastWriteTime: 2016-01-22T06:15:31.619000000Z 724.11c4: ChangeTime: 2016-02-14T17:13:12.312590000Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x11c000 724.11c4: NT Headers: 0xe8 724.11c4: Timestamp: 0x56a1c9ab 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56a1c9ab 724.11c4: Image Version: 6.1 724.11c4: SizeOfImage: 0x11f000 (1175552) 724.11c4: Resource Dir: 0x116000 LB 0x528 724.11c4: ProductName: Microsoft® Windows® Operating System 724.11c4: ProductVersion: 6.1.7601.19135 724.11c4: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 724.11c4: FileDescription: Windows NT BASE API Client DLL 724.11c4: \SystemRoot\System32\KernelBase.dll: 724.11c4: CreationTime: 2016-02-10T01:51:20.807947700Z 724.11c4: LastWriteTime: 2016-01-22T06:15:31.822000000Z 724.11c4: ChangeTime: 2016-02-14T17:13:12.312590000Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x67200 724.11c4: NT Headers: 0xe8 724.11c4: Timestamp: 0x56a1c9ac 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56a1c9ac 724.11c4: Image Version: 6.1 724.11c4: SizeOfImage: 0x6b000 (438272) 724.11c4: Resource Dir: 0x69000 LB 0x530 724.11c4: ProductName: Microsoft® Windows® Operating System 724.11c4: ProductVersion: 6.1.7601.19135 724.11c4: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 724.11c4: FileDescription: Windows NT BASE API Client DLL 724.11c4: \SystemRoot\System32\apisetschema.dll: 724.11c4: CreationTime: 2016-02-10T01:51:11.224886700Z 724.11c4: LastWriteTime: 2016-01-22T06:12:25.181000000Z 724.11c4: ChangeTime: 2016-02-14T17:13:12.016189500Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x1a00 724.11c4: NT Headers: 0xc0 724.11c4: Timestamp: 0x56a1c890 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56a1c890 724.11c4: Image Version: 6.1 724.11c4: SizeOfImage: 0x50000 (327680) 724.11c4: Resource Dir: 0x30000 LB 0x3f8 724.11c4: ProductName: Microsoft® Windows® Operating System 724.11c4: ProductVersion: 6.1.7601.19135 724.11c4: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 724.11c4: FileDescription: ApiSet Schema DLL 724.11c4: NtOpenDirectoryObject failed on \Driver: 0xc0000022 724.11c4: supR3HardenedWinFindAdversaries: 0x400 724.11c4: \SystemRoot\System32\drivers\MpFilter.sys: 724.11c4: CreationTime: 2015-11-13T07:50:26.000000000Z 724.11c4: LastWriteTime: 2015-11-13T07:50:26.000000000Z 724.11c4: ChangeTime: 2016-02-25T15:20:53.247049600Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x46960 724.11c4: NT Headers: 0xe8 724.11c4: Timestamp: 0x56330e4f 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56330e4f 724.11c4: Image Version: 6.3 724.11c4: SizeOfImage: 0x44000 (278528) 724.11c4: Resource Dir: 0x42000 LB 0xd90 724.11c4: ProductName: Microsoft Malware Protection 724.11c4: ProductVersion: 4.9.0210.0 724.11c4: FileVersion: 4.9.0210.0 724.11c4: FileDescription: Microsoft antimalware file system filter driver 724.11c4: \SystemRoot\System32\drivers\NisDrvWFP.sys: 724.11c4: CreationTime: 2015-03-04T16:34:52.000000000Z 724.11c4: LastWriteTime: 2015-11-13T07:50:26.000000000Z 724.11c4: ChangeTime: 2016-02-25T15:20:52.217447700Z 724.11c4: FileAttributes: 0x20 724.11c4: Size: 0x20ab8 724.11c4: NT Headers: 0xe0 724.11c4: Timestamp: 0x56330e8a 724.11c4: Machine: 0x8664 - amd64 724.11c4: Timestamp: 0x56330e8a 724.11c4: Image Version: 6.3 724.11c4: SizeOfImage: 0x1f000 (126976) 724.11c4: Resource Dir: 0x1c000 LB 0x1b90 724.11c4: ProductName: Microsoft Malware Protection 724.11c4: ProductVersion: 4.9.0210.0 724.11c4: FileVersion: 4.9.0210.0 724.11c4: FileDescription: Microsoft Network Realtime Inspection Driver 724.11c4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 724.11c4: Calling main() 724.11c4: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2 724.11c4: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 724.11c4: SUPR3HardenedMain: Respawn #1 724.11c4: System32: \Device\HarddiskVolume4\Windows\System32 724.11c4: WinSxS: \Device\HarddiskVolume4\Windows\winsxs 724.11c4: KnownDllPath: C:\Windows\system32 724.11c4: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 724.11c4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe) 724.11c4: supR3HardNtEnableThreadCreation: 724.11c4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007778b170 pvNtTerminateThread=00000000777ad8e0 724.11c4: supR3HardenedWinDoReSpawn(1): New child 14d8.1a04 [kernel32]. 724.11c4: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380 724.11c4: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077760000 uNtDllChildAddr=0000000077760000 724.11c4: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007778b170 724.11c4: supR3HardenedWinSetupChildInit: Start child. 724.11c4: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 2 ms. 724.11c4: supR3HardNtChildPurify: Startup delay kludge #1/0: 520 ms, 59 sleeps 724.11c4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION 724.11c4: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000 724.11c4: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000 724.11c4: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000 724.11c4: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000 724.11c4: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000 724.11c4: 0000000000041000-0000000000031fff 0x0001/0x0000 0x0000000 724.11c4: *0000000000050000-fffffffffff53fff 0x0000/0x0004 0x0020000 724.11c4: 000000000014c000-0000000000148fff 0x0104/0x0004 0x0020000 724.11c4: 000000000014f000-000000000014dfff 0x0004/0x0004 0x0020000 724.11c4: 0000000000150000-ffffffff88b3ffff 0x0001/0x0000 0x0000000 724.11c4: *0000000077760000-0000000077760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 0000000077761000-000000007785ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 0000000077860000-000000007788efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 000000007788f000-0000000077896fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 0000000077897000-0000000077897fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 0000000077898000-000000007789afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 000000007789b000-0000000077909fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 724.11c4: 000000007790a000-0000000070233fff 0x0001/0x0000 0x0000000 724.11c4: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000 724.11c4: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000 724.11c4: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000 724.11c4: 000000007fff0000-ffffffffc0deffff 0x0001/0x0000 0x0000000 724.11c4: *000000013f1f0000-000000013f1f0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f1f1000-000000013f277fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f278000-000000013f278fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f279000-000000013f2c3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2c4000-000000013f2c4fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2c5000-000000013f2c5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2c6000-000000013f2cafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2cb000-000000013f2cbfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2cc000-000000013f2ccfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2cd000-000000013f2d0fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f2d1000-000000013f31bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe 724.11c4: 000000013f31c000-fffff8037ebb7fff 0x0001/0x0000 0x0000000 724.11c4: *000007feffa80000-000007feffa80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\apisetschema.dll 724.11c4: 000007feffa81000-000007fdff551fff 0x0001/0x0000 0x0000000 724.11c4: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000 724.11c4: 000007fffffd3000-000007fffffc8fff 0x0001/0x0000 0x0000000 724.11c4: *000007fffffdd000-000007fffffdafff 0x0004/0x0004 0x0020000 724.11c4: *000007fffffdf000-000007fffffddfff 0x0004/0x0004 0x0020000 724.11c4: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000 724.11c4: apisetschema.dll: timestamp 0x56a1c890 (rc=VINF_SUCCESS) 724.11c4: VirtualBox.exe: timestamp 0x56d9b7eb (rc=VINF_SUCCESS) 724.11c4: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 724.11c4: '\Device\HarddiskVolume4\Windows\System32\apisetschema.dll' has no imports 724.11c4: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports 724.11c4: supR3HardNtChildPurify: Done after 550 ms and 0 fixes (loop #0). 14d8.1a04: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100 14d8.1a04: supR3HardenedVmProcessInit: uNtDllAddr=0000000077760000 g_uNtVerCombined=0x611db100 14d8.1a04: ntdll.dll: timestamp 0x56a1c9c5 (rc=VINF_SUCCESS) 14d8.1a04: New simple heap: #1 0000000000250000 LB 0x400000 (for 1744896 allocation) 724.11c4: supR3HardNtEnableThreadCreation: 14d8.1a04: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 14d8.1a04: System32: \Device\HarddiskVolume4\Windows\System32 14d8.1a04: WinSxS: \Device\HarddiskVolume4\Windows\winsxs 14d8.1a04: KnownDllPath: C:\Windows\system32 14d8.1a04: supR3HardenedVmProcessInit: Opening vboxdrv stub... 14d8.1a04: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk... 14d8.1a04: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk... 14d8.1a04: Registered Dll notification callback with NTDLL. 14d8.1a04: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll) 14d8.1a04: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll 14d8.1a04: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000: [calling] 14d8.1a04: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust] 724.11c4: Error (rc=258): 724.11c4: Timed out after 60001 ms waiting for child request #1 (CloseEvents). 724.11c4: Error 258 in supR3HardNtChildWaitFor! (enmWhat=5) 724.11c4: Timed out after 60001 ms waiting for child request #1 (CloseEvents). 410.1820: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110 410.1820: \SystemRoot\System32\ntdll.dll: 410.1820: CreationTime: 2016-02-10T01:51:21.167950400Z 410.1820: LastWriteTime: 2016-01-22T06:24:12.217581500Z 410.1820: ChangeTime: 2016-02-14T17:13:12.062989500Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x1a73d8 410.1820: NT Headers: 0xe0 410.1820: Timestamp: 0x56a1c9c5 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56a1c9c5 410.1820: Image Version: 6.1 410.1820: SizeOfImage: 0x1aa000 (1744896) 410.1820: Resource Dir: 0x14e000 LB 0x5a028 410.1820: ProductName: Microsoft® Windows® Operating System 410.1820: ProductVersion: 6.1.7601.19135 410.1820: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 410.1820: FileDescription: NT Layer DLL 410.1820: \SystemRoot\System32\kernel32.dll: 410.1820: CreationTime: 2016-02-10T01:51:19.351937500Z 410.1820: LastWriteTime: 2016-01-22T06:15:31.619000000Z 410.1820: ChangeTime: 2016-02-14T17:13:12.312590000Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x11c000 410.1820: NT Headers: 0xe8 410.1820: Timestamp: 0x56a1c9ab 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56a1c9ab 410.1820: Image Version: 6.1 410.1820: SizeOfImage: 0x11f000 (1175552) 410.1820: Resource Dir: 0x116000 LB 0x528 410.1820: ProductName: Microsoft® Windows® Operating System 410.1820: ProductVersion: 6.1.7601.19135 410.1820: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 410.1820: FileDescription: Windows NT BASE API Client DLL 410.1820: \SystemRoot\System32\KernelBase.dll: 410.1820: CreationTime: 2016-02-10T01:51:20.807947700Z 410.1820: LastWriteTime: 2016-01-22T06:15:31.822000000Z 410.1820: ChangeTime: 2016-02-14T17:13:12.312590000Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x67200 410.1820: NT Headers: 0xe8 410.1820: Timestamp: 0x56a1c9ac 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56a1c9ac 410.1820: Image Version: 6.1 410.1820: SizeOfImage: 0x6b000 (438272) 410.1820: Resource Dir: 0x69000 LB 0x530 410.1820: ProductName: Microsoft® Windows® Operating System 410.1820: ProductVersion: 6.1.7601.19135 410.1820: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 410.1820: FileDescription: Windows NT BASE API Client DLL 410.1820: \SystemRoot\System32\apisetschema.dll: 410.1820: CreationTime: 2016-02-10T01:51:11.224886700Z 410.1820: LastWriteTime: 2016-01-22T06:12:25.181000000Z 410.1820: ChangeTime: 2016-02-14T17:13:12.016189500Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x1a00 410.1820: NT Headers: 0xc0 410.1820: Timestamp: 0x56a1c890 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56a1c890 410.1820: Image Version: 6.1 410.1820: SizeOfImage: 0x50000 (327680) 410.1820: Resource Dir: 0x30000 LB 0x3f8 410.1820: ProductName: Microsoft® Windows® Operating System 410.1820: ProductVersion: 6.1.7601.19135 410.1820: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 410.1820: FileDescription: ApiSet Schema DLL 410.1820: NtOpenDirectoryObject failed on \Driver: 0xc0000022 410.1820: supR3HardenedWinFindAdversaries: 0x400 410.1820: \SystemRoot\System32\drivers\MpFilter.sys: 410.1820: CreationTime: 2015-11-13T07:50:26.000000000Z 410.1820: LastWriteTime: 2015-11-13T07:50:26.000000000Z 410.1820: ChangeTime: 2016-02-25T15:20:53.247049600Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x46960 410.1820: NT Headers: 0xe8 410.1820: Timestamp: 0x56330e4f 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56330e4f 410.1820: Image Version: 6.3 410.1820: SizeOfImage: 0x44000 (278528) 410.1820: Resource Dir: 0x42000 LB 0xd90 410.1820: ProductName: Microsoft Malware Protection 410.1820: ProductVersion: 4.9.0210.0 410.1820: FileVersion: 4.9.0210.0 410.1820: FileDescription: Microsoft antimalware file system filter driver 410.1820: \SystemRoot\System32\drivers\NisDrvWFP.sys: 410.1820: CreationTime: 2015-03-04T16:34:52.000000000Z 410.1820: LastWriteTime: 2015-11-13T07:50:26.000000000Z 410.1820: ChangeTime: 2016-02-25T15:20:52.217447700Z 410.1820: FileAttributes: 0x20 410.1820: Size: 0x20ab8 410.1820: NT Headers: 0xe0 410.1820: Timestamp: 0x56330e8a 410.1820: Machine: 0x8664 - amd64 410.1820: Timestamp: 0x56330e8a 410.1820: Image Version: 6.3 410.1820: SizeOfImage: 0x1f000 (126976) 410.1820: Resource Dir: 0x1c000 LB 0x1b90 410.1820: ProductName: Microsoft Malware Protection 410.1820: ProductVersion: 4.9.0210.0 410.1820: FileVersion: 4.9.0210.0 410.1820: FileDescription: Microsoft Network Realtime Inspection Driver 410.1820: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 410.1820: Calling main() 410.1820: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x3 410.1820: supR3HardenedWinInitAppBin(0x3): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 410.1820: System32: \Device\HarddiskVolume4\Windows\System32 410.1820: WinSxS: \Device\HarddiskVolume4\Windows\winsxs 410.1820: KnownDllPath: C:\Windows\system32 410.1820: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports 410.1820: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe) 410.1820: supR3HardNtEnableThreadCreation: 410.1820: bcrypt.dll loaded at 000007fefce10000, BCryptOpenAlgorithmProvider at 000007fefce12640, preloading providers: 410.1820: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000003337e0) 410.1820: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=0000000000333d50) 410.1820: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=0000000000333e70) 410.1820: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=0000000000334130) 410.1820: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=0000000000333f90) 410.1820: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=0000000000334a50) 410.1820: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=0000000000334c90) 410.1820: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=0000000000334db0) 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=881FA305C5390C7D979151AFB211130389B9E066 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_88_for_KB3126587~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\SystemRoot\System32\ntdll.dll' 410.1820: g_pfnWinVerifyTrust=000007fefd671010 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000430 pwszName=\Device\HarddiskVolume4\Windows\System32\crypt32.dll 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BFD41401EDEBD4D914977D62B588ECABEE60CFD3 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_112_for_KB3040272~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume4\Windows\System32\crypt32.dll' 410.1820: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900) 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'. 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'. 410.1820: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\crypt32.dll) WinVerifyTrust 410.1820: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\crypt32.dll 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000450 pwszName=\Device\HarddiskVolume4\Windows\System32\wintrust.dll 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000031fd8d0 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E1BBE4EB6D114F50142F24E2E2749EFD81021486 410.1820: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_75_for_KB3040272~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume4\Windows\System32\wintrust.dll' 410.1820: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900) 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'. 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'. 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'. 410.1820: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'. 410.1820: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wintrust.dll) WinVerifyTrust 410.1820: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wintrust.dll 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority 410.1820: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=US, O=Thawte, Inc., CN=Thawte SGC CA - G2 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011 410.1820: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp. 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc. 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x91e3728b8b40d000 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x6e864c7a8071ba00 C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x20a3c30cad008000 C=ES, O=DIRECCION GENERAL DE LA POLICIA, OU=DNIE, CN=AC RAIZ DNIE 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xabd0695c5d11d15e C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x802b3770cb00af00 C=EU, L=Madrid (see current address at www.camerfirma.com/address) 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x35f812d09650dc00 C=FR, O=Certplus, CN=Class 2 Primary CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x20b7075b3689b600 C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x4297e24fc722b300 C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xab549401526569d3 L=Internet, O=VeriSign, Inc., OU=VeriSign Commercial Software Publishers CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xa8b43f38c3f7b100 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root 410.1820: supR3HardenedWinIsDesiredRootCA: Adding 0xf03913fae404bc00 C=KR, O=KISA, OU=Korea Certification Authority Central, CN=KISA RootCA 1 410.1820: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=56 410.1820: SUPR3HardenedMain: Load Runtime... 410.1820: SUPR3HardenedMain: Load TrustedMain... 410.1820: SUPR3HardenedMain: Calling TrustedMain (000007fed9dc10f0)... 11d8.14e8: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000020 g_uNtVerCombined=0x611db110 11d8.14e8: \SystemRoot\System32\ntdll.dll: 11d8.14e8: CreationTime: 2016-02-10T01:51:21.167950400Z 11d8.14e8: LastWriteTime: 2016-01-22T06:24:12.217581500Z 11d8.14e8: ChangeTime: 2016-02-14T17:13:12.062989500Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x1a73d8 11d8.14e8: NT Headers: 0xe0 11d8.14e8: Timestamp: 0x56a1c9c5 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56a1c9c5 11d8.14e8: Image Version: 6.1 11d8.14e8: SizeOfImage: 0x1aa000 (1744896) 11d8.14e8: Resource Dir: 0x14e000 LB 0x5a028 11d8.14e8: ProductName: Microsoft® Windows® Operating System 11d8.14e8: ProductVersion: 6.1.7601.19135 11d8.14e8: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 11d8.14e8: FileDescription: NT Layer DLL 11d8.14e8: \SystemRoot\System32\kernel32.dll: 11d8.14e8: CreationTime: 2016-02-10T01:51:19.351937500Z 11d8.14e8: LastWriteTime: 2016-01-22T06:15:31.619000000Z 11d8.14e8: ChangeTime: 2016-02-14T17:13:12.312590000Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x11c000 11d8.14e8: NT Headers: 0xe8 11d8.14e8: Timestamp: 0x56a1c9ab 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56a1c9ab 11d8.14e8: Image Version: 6.1 11d8.14e8: SizeOfImage: 0x11f000 (1175552) 11d8.14e8: Resource Dir: 0x116000 LB 0x528 11d8.14e8: ProductName: Microsoft® Windows® Operating System 11d8.14e8: ProductVersion: 6.1.7601.19135 11d8.14e8: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 11d8.14e8: FileDescription: Windows NT BASE API Client DLL 11d8.14e8: \SystemRoot\System32\KernelBase.dll: 11d8.14e8: CreationTime: 2016-02-10T01:51:20.807947700Z 11d8.14e8: LastWriteTime: 2016-01-22T06:15:31.822000000Z 11d8.14e8: ChangeTime: 2016-02-14T17:13:12.312590000Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x67200 11d8.14e8: NT Headers: 0xe8 11d8.14e8: Timestamp: 0x56a1c9ac 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56a1c9ac 11d8.14e8: Image Version: 6.1 11d8.14e8: SizeOfImage: 0x6b000 (438272) 11d8.14e8: Resource Dir: 0x69000 LB 0x530 11d8.14e8: ProductName: Microsoft® Windows® Operating System 11d8.14e8: ProductVersion: 6.1.7601.19135 11d8.14e8: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 11d8.14e8: FileDescription: Windows NT BASE API Client DLL 11d8.14e8: \SystemRoot\System32\apisetschema.dll: 11d8.14e8: CreationTime: 2016-02-10T01:51:11.224886700Z 11d8.14e8: LastWriteTime: 2016-01-22T06:12:25.181000000Z 11d8.14e8: ChangeTime: 2016-02-14T17:13:12.016189500Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x1a00 11d8.14e8: NT Headers: 0xc0 11d8.14e8: Timestamp: 0x56a1c890 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56a1c890 11d8.14e8: Image Version: 6.1 11d8.14e8: SizeOfImage: 0x50000 (327680) 11d8.14e8: Resource Dir: 0x30000 LB 0x3f8 11d8.14e8: ProductName: Microsoft® Windows® Operating System 11d8.14e8: ProductVersion: 6.1.7601.19135 11d8.14e8: FileVersion: 6.1.7601.19135 (win7sp1_gdr.160121-1718) 11d8.14e8: FileDescription: ApiSet Schema DLL 11d8.14e8: NtOpenDirectoryObject failed on \Driver: 0xc0000022 11d8.14e8: supR3HardenedWinFindAdversaries: 0x400 11d8.14e8: \SystemRoot\System32\drivers\MpFilter.sys: 11d8.14e8: CreationTime: 2015-11-13T07:50:26.000000000Z 11d8.14e8: LastWriteTime: 2015-11-13T07:50:26.000000000Z 11d8.14e8: ChangeTime: 2016-02-25T15:20:53.247049600Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x46960 11d8.14e8: NT Headers: 0xe8 11d8.14e8: Timestamp: 0x56330e4f 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56330e4f 11d8.14e8: Image Version: 6.3 11d8.14e8: SizeOfImage: 0x44000 (278528) 11d8.14e8: Resource Dir: 0x42000 LB 0xd90 11d8.14e8: ProductName: Microsoft Malware Protection 11d8.14e8: ProductVersion: 4.9.0210.0 11d8.14e8: FileVersion: 4.9.0210.0 11d8.14e8: FileDescription: Microsoft antimalware file system filter driver 11d8.14e8: \SystemRoot\System32\drivers\NisDrvWFP.sys: 11d8.14e8: CreationTime: 2015-03-04T16:34:52.000000000Z 11d8.14e8: LastWriteTime: 2015-11-13T07:50:26.000000000Z 11d8.14e8: ChangeTime: 2016-02-25T15:20:52.217447700Z 11d8.14e8: FileAttributes: 0x20 11d8.14e8: Size: 0x20ab8 11d8.14e8: NT Headers: 0xe0 11d8.14e8: Timestamp: 0x56330e8a 11d8.14e8: Machine: 0x8664 - amd64 11d8.14e8: Timestamp: 0x56330e8a 11d8.14e8: Image Version: 6.3 11d8.14e8: SizeOfImage: 0x1f000 (126976) 11d8.14e8: Resource Dir: 0x1c000 LB 0x1b90 11d8.14e8: ProductName: Microsoft Malware Protection 11d8.14e8: ProductVersion: 4.9.0210.0 11d8.14e8: FileVersion: 4.9.0210.0 11d8.14e8: FileDescription: Microsoft Network Realtime Inspection Driver 11d8.14e8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 11d8.14e8: Calling main() 11d8.14e8: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0 11d8.14e8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' 11d8.14e8: SUPR3HardenedMain: Respawn #1 11d8.14e8: System32: \Device\HarddiskVolume4\Windows\System32 11d8.14e8: WinSxS: \Device\HarddiskVolume4\Windows\winsxs 11d8.14e8: KnownDllPath: C:\Windows\system32 11d8.14e8: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports 11d8.14e8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe) 11d8.14e8: supR3HardNtEnableThreadCreation: 11d8.14e8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007778b170 pvNtTerminateThread=00000000777ad8e0 11d8.14e8: supR3HardenedWinDoReSpawn(1): New child dd0.1804 [kernel32]. 11d8.14e8: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380 11d8.14e8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077760000 uNtDllChildAddr=0000000077760000 11d8.14e8: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007778b170 11d8.14e8: supR3HardenedWinSetupChildInit: Start child. 11d8.14e8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms. 11d8.14e8: supR3HardNtChildPurify: Startup delay kludge #1/0: 522 ms, 52 sleeps 11d8.14e8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION 11d8.14e8: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000 11d8.14e8: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000 11d8.14e8: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000 11d8.14e8: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000 11d8.14e8: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000 11d8.14e8: 0000000000041000-ffffffffffe81fff 0x0001/0x0000 0x0000000 11d8.14e8: *0000000000200000-0000000000103fff 0x0000/0x0004 0x0020000 11d8.14e8: 00000000002fc000-00000000002f8fff 0x0104/0x0004 0x0020000 11d8.14e8: 00000000002ff000-00000000002fdfff 0x0004/0x0004 0x0020000 11d8.14e8: 0000000000300000-ffffffff88e9ffff 0x0001/0x0000 0x0000000 11d8.14e8: *0000000077760000-0000000077760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 0000000077761000-000000007785ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 0000000077860000-000000007788efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 000000007788f000-0000000077896fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 0000000077897000-0000000077897fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 0000000077898000-000000007789afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 000000007789b000-0000000077909fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll 11d8.14e8: 000000007790a000-0000000070233fff 0x0001/0x0000 0x0000000 11d8.14e8: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000 11d8.14e8: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000 11d8.14e8: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000 11d8.14e8: 000000007fff0000-ffffffffc09cffff 0x0001/0x0000 0x0000000 11d8.14e8: *000000013f610000-000000013f610fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f611000-000000013f697fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f698000-000000013f698fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f699000-000000013f6e3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6e4000-000000013f6e4fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6e5000-000000013f6e5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6e6000-000000013f6eafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6eb000-000000013f6ebfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6ec000-000000013f6ecfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6ed000-000000013f6f0fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f6f1000-000000013f73bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe 11d8.14e8: 000000013f73c000-fffff8037f3f7fff 0x0001/0x0000 0x0000000 11d8.14e8: *000007feffa80000-000007feffa80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\apisetschema.dll 11d8.14e8: 000007feffa81000-000007fdff551fff 0x0001/0x0000 0x0000000 11d8.14e8: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000 11d8.14e8: 000007fffffd3000-000007fffffc8fff 0x0001/0x0000 0x0000000 11d8.14e8: *000007fffffdd000-000007fffffdafff 0x0004/0x0004 0x0020000 11d8.14e8: *000007fffffdf000-000007fffffddfff 0x0004/0x0004 0x0020000 11d8.14e8: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000 11d8.14e8: apisetschema.dll: timestamp 0x56a1c890 (rc=VINF_SUCCESS) 11d8.14e8: VBoxHeadless.exe: timestamp 0x56d9b7eb (rc=VINF_SUCCESS) 11d8.14e8: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports 11d8.14e8: '\Device\HarddiskVolume4\Windows\System32\apisetschema.dll' has no imports 11d8.14e8: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports 11d8.14e8: supR3HardNtChildPurify: Done after 552 ms and 0 fixes (loop #0). dd0.1804: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100 dd0.1804: supR3HardenedVmProcessInit: uNtDllAddr=0000000077760000 g_uNtVerCombined=0x611db100 dd0.1804: ntdll.dll: timestamp 0x56a1c9c5 (rc=VINF_SUCCESS) dd0.1804: New simple heap: #1 0000000000300000 LB 0x400000 (for 1744896 allocation) 11d8.14e8: supR3HardNtEnableThreadCreation: dd0.1804: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox' dd0.1804: System32: \Device\HarddiskVolume4\Windows\System32 dd0.1804: WinSxS: \Device\HarddiskVolume4\Windows\winsxs dd0.1804: KnownDllPath: C:\Windows\system32 dd0.1804: supR3HardenedVmProcessInit: Opening vboxdrv stub... dd0.1804: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk... dd0.1804: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk... dd0.1804: Registered Dll notification callback with NTDLL. dd0.1804: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll) dd0.1804: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll dd0.1804: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000: [calling] dd0.1804: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust] 11d8.14e8: Error (rc=258): 11d8.14e8: Timed out after 60001 ms waiting for child request #1 (CloseEvents). 11d8.14e8: Error 258 in supR3HardNtChildWaitFor! (enmWhat=5) 11d8.14e8: Timed out after 60001 ms waiting for child request #1 (CloseEvents). 410.1820: Terminating the normal way: rcExit=0