VirtualBox

Ticket #15175: VBoxHardening.log

File VBoxHardening.log, 11.9 KB (added by Hanns Wu, 9 years ago)
Line 
12e44.2de0: Log file opened: 5.0.14r105127 g_hStartupLog=0000000000000058 g_uNtVerCombined=0xa037bb00
22e44.2de0: \SystemRoot\System32\ntdll.dll:
32e44.2de0: CreationTime: 2016-02-13T16:47:16.059499300Z
42e44.2de0: LastWriteTime: 2016-02-13T16:47:16.059499300Z
52e44.2de0: ChangeTime: 2016-02-23T14:01:55.270597700Z
62e44.2de0: FileAttributes: 0x20
72e44.2de0: Size: 0x1c4538
82e44.2de0: NT Headers: 0xd8
92e44.2de0: Timestamp: 0x56bf26dc
102e44.2de0: Machine: 0x8664 - amd64
112e44.2de0: Timestamp: 0x56bf26dc
122e44.2de0: Image Version: 10.0
132e44.2de0: SizeOfImage: 0x1ca000 (1875968)
142e44.2de0: Resource Dir: 0x162000 LB 0x66370
152e44.2de0: ProductName: Microsoft® Windows® Operating System
162e44.2de0: ProductVersion: 10.0.14267.1000
172e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213)
182e44.2de0: FileDescription: NT Layer DLL
192e44.2de0: \SystemRoot\System32\kernel32.dll:
202e44.2de0: CreationTime: 2016-02-13T16:46:59.043908100Z
212e44.2de0: LastWriteTime: 2016-02-13T16:46:59.043908100Z
222e44.2de0: ChangeTime: 2016-02-23T14:01:54.426796600Z
232e44.2de0: FileAttributes: 0x20
242e44.2de0: Size: 0xa9990
252e44.2de0: NT Headers: 0xf8
262e44.2de0: Timestamp: 0x56bf2799
272e44.2de0: Machine: 0x8664 - amd64
282e44.2de0: Timestamp: 0x56bf2799
292e44.2de0: Image Version: 10.0
302e44.2de0: SizeOfImage: 0xab000 (700416)
312e44.2de0: Resource Dir: 0xa9000 LB 0x528
322e44.2de0: ProductName: Microsoft® Windows® Operating System
332e44.2de0: ProductVersion: 10.0.14267.1000
342e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213)
352e44.2de0: FileDescription: Windows NT BASE API Client DLL
362e44.2de0: \SystemRoot\System32\KernelBase.dll:
372e44.2de0: CreationTime: 2016-02-13T16:47:16.184498700Z
382e44.2de0: LastWriteTime: 2016-02-13T16:47:16.184498700Z
392e44.2de0: ChangeTime: 2016-02-23T14:01:54.458048700Z
402e44.2de0: FileAttributes: 0x20
412e44.2de0: Size: 0x1f0d48
422e44.2de0: NT Headers: 0x100
432e44.2de0: Timestamp: 0x56bf2742
442e44.2de0: Machine: 0x8664 - amd64
452e44.2de0: Timestamp: 0x56bf2742
462e44.2de0: Image Version: 10.0
472e44.2de0: SizeOfImage: 0x1f3000 (2043904)
482e44.2de0: Resource Dir: 0x1db000 LB 0x540
492e44.2de0: ProductName: Microsoft® Windows® Operating System
502e44.2de0: ProductVersion: 10.0.14267.1000
512e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213)
522e44.2de0: FileDescription: Windows NT BASE API Client DLL
532e44.2de0: \SystemRoot\System32\apisetschema.dll:
542e44.2de0: CreationTime: 2016-02-13T16:47:09.278262500Z
552e44.2de0: LastWriteTime: 2016-02-13T16:47:09.278262500Z
562e44.2de0: ChangeTime: 2016-02-23T14:01:53.098591300Z
572e44.2de0: FileAttributes: 0x20
582e44.2de0: Size: 0x16910
592e44.2de0: NT Headers: 0xc0
602e44.2de0: Timestamp: 0x56bf2960
612e44.2de0: Machine: 0x8664 - amd64
622e44.2de0: Timestamp: 0x56bf2960
632e44.2de0: Image Version: 10.0
642e44.2de0: SizeOfImage: 0x18000 (98304)
652e44.2de0: Resource Dir: 0x17000 LB 0x400
662e44.2de0: ProductName: Microsoft® Windows® Operating System
672e44.2de0: ProductVersion: 10.0.14267.1000
682e44.2de0: FileVersion: 10.0.14267.1000 (rs1_release.160213-0213)
692e44.2de0: FileDescription: ApiSet Schema DLL
702e44.2de0: NtOpenDirectoryObject failed on \Driver: 0xc0000022
712e44.2de0: supR3HardenedWinFindAdversaries: 0x800
722e44.2de0: \SystemRoot\System32\drivers\cfrmd.sys:
732e44.2de0: CreationTime: 2014-06-26T05:33:42.000000000Z
742e44.2de0: LastWriteTime: 2015-10-10T17:09:25.447875000Z
752e44.2de0: ChangeTime: 2016-02-23T14:12:44.741356400Z
762e44.2de0: FileAttributes: 0x20
772e44.2de0: Size: 0x9d20
782e44.2de0: NT Headers: 0xe8
792e44.2de0: Timestamp: 0x5004f2a1
802e44.2de0: Machine: 0x8664 - amd64
812e44.2de0: Timestamp: 0x5004f2a1
822e44.2de0: Image Version: 6.1
832e44.2de0: SizeOfImage: 0xe000 (57344)
842e44.2de0: Resource Dir: 0xc000 LB 0x3e0
852e44.2de0: ProductName: Windows (R) Win 7 DDK driver
862e44.2de0: ProductVersion: 6.1.7600.16385
872e44.2de0: FileVersion: 6.1.7600.16385 built by: WinDDK
882e44.2de0: FileDescription: Safe Deletion Driver
892e44.2de0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox'
902e44.2de0: Calling main()
912e44.2de0: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
922e44.2de0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox'
932e44.2de0: SUPR3HardenedMain: Respawn #1
942e44.2de0: System32: \Device\HarddiskVolume6\Windows\System32
952e44.2de0: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS
962e44.2de0: KnownDllPath: C:\WINDOWS\system32
972e44.2de0: '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
982e44.2de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe)
992e44.2de0: supR3HardNtEnableThreadCreation:
1002e44.2de0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc36fcb5a0 pvNtTerminateThread=00007ffc37041980
1012e44.2de0: supR3HardenedWinDoReSpawn(1): New child 2d54.2c18 [kernel32].
1022e44.2de0: supR3HardNtChildGatherData: PebBaseAddress=00000000002cb000 cbPeb=0x388
1032e44.2de0: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffc36fa0000 uNtDllChildAddr=00007ffc36fa0000
1042e44.2de0: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffc36fcb5a0
1052e44.2de0: supR3HardenedWinSetupChildInit: Start child.
1062e44.2de0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
1072e44.2de0: supR3HardNtChildPurify: Startup delay kludge #1/0: 515 ms, 59 sleeps
1082e44.2de0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
1092e44.2de0: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
1102e44.2de0: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
1112e44.2de0: *0000000000030000-000000000001afff 0x0002/0x0002 0x0040000
1122e44.2de0: 0000000000045000-0000000000039fff 0x0001/0x0000 0x0000000
1132e44.2de0: *0000000000050000-fffffffffff53fff 0x0000/0x0004 0x0020000
1142e44.2de0: 000000000014c000-0000000000148fff 0x0104/0x0004 0x0020000
1152e44.2de0: 000000000014f000-000000000014dfff 0x0004/0x0004 0x0020000
1162e44.2de0: *0000000000150000-000000000014bfff 0x0002/0x0002 0x0040000
1172e44.2de0: 0000000000154000-0000000000147fff 0x0001/0x0000 0x0000000
1182e44.2de0: *0000000000160000-000000000015dfff 0x0004/0x0004 0x0020000
1192e44.2de0: 0000000000162000-00000000000c3fff 0x0001/0x0000 0x0000000
1202e44.2de0: *0000000000200000-0000000000134fff 0x0000/0x0004 0x0020000
1212e44.2de0: 00000000002cb000-00000000002c7fff 0x0004/0x0004 0x0020000
1222e44.2de0: 00000000002ce000-000000000019bfff 0x0000/0x0004 0x0020000
1232e44.2de0: 0000000000400000-ffffffff8081ffff 0x0001/0x0000 0x0000000
1242e44.2de0: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
1252e44.2de0: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
1262e44.2de0: 000000007fff0000-ffff800a3b22ffff 0x0001/0x0000 0x0000000
1272e44.2de0: *00007ff6c4db0000-00007ff6c4d7cfff 0x0002/0x0002 0x0040000
1282e44.2de0: 00007ff6c4de3000-00007ff6c4395fff 0x0001/0x0000 0x0000000
1292e44.2de0: *00007ff6c5830000-00007ff6c5830fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1302e44.2de0: 00007ff6c5831000-00007ff6c58b7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1312e44.2de0: 00007ff6c58b8000-00007ff6c58b8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1322e44.2de0: 00007ff6c58b9000-00007ff6c5903fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1332e44.2de0: 00007ff6c5904000-00007ff6c5904fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1342e44.2de0: 00007ff6c5905000-00007ff6c5905fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1352e44.2de0: 00007ff6c5906000-00007ff6c590afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1362e44.2de0: 00007ff6c590b000-00007ff6c590bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1372e44.2de0: 00007ff6c590c000-00007ff6c590cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1382e44.2de0: 00007ff6c590d000-00007ff6c5910fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1392e44.2de0: 00007ff6c5911000-00007ff6c595bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
1402e44.2de0: 00007ff6c595c000-00007ff154317fff 0x0001/0x0000 0x0000000
1412e44.2de0: *00007ffc36fa0000-00007ffc36fa0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1422e44.2de0: 00007ffc36fa1000-00007ffc370a4fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1432e44.2de0: 00007ffc370a5000-00007ffc370e6fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1442e44.2de0: 00007ffc370e7000-00007ffc370effff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1452e44.2de0: 00007ffc370f0000-00007ffc370fdfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1462e44.2de0: 00007ffc370fe000-00007ffc370fefff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1472e44.2de0: 00007ffc370ff000-00007ffc37101fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1482e44.2de0: 00007ffc37102000-00007ffc37169fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\Windows\System32\ntdll.dll
1492e44.2de0: 00007ffc3716a000-00007ff86e2f3fff 0x0001/0x0000 0x0000000
1502e44.2de0: *00007ffffffe0000-00007ffffffcffff 0x0001/0x0002 0x0020000
1512e44.2de0: VirtualBox.exe: timestamp 0x569e6712 (rc=VINF_SUCCESS)
1522e44.2de0: '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
1532e44.2de0: '\Device\HarddiskVolume6\Windows\System32\ntdll.dll' has no imports
1542e44.2de0: supR3HardNtChildPurify: Done after 561 ms and 0 fixes (loop #0).
1552e44.2de0: supR3HardNtEnableThreadCreation:
1562d54.2c18: Log file opened: 5.0.14r105127 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa037bb00
1572d54.2c18: supR3HardenedVmProcessInit: uNtDllAddr=00007ffc36fa0000
1582d54.2c18: ntdll.dll: timestamp 0x56bf26dc (rc=VINF_SUCCESS)
1592d54.2c18: New simple heap: #1 0000000000500000 LB 0x400000 (for 1875968 allocation)
1602d54.2c18: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox'
1612d54.2c18: System32: \Device\HarddiskVolume6\Windows\System32
1622d54.2c18: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS
1632d54.2c18: KnownDllPath: C:\WINDOWS\system32
1642d54.2c18: supR3HardenedVmProcessInit: Opening vboxdrv stub...
1652d54.2c18: supR3HardenedWinReadErrorInfoDevice: 'ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da'
1662d54.2c18: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3)
1672d54.2c18: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
168VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da
1692e44.2de0: supR3HardenedWinCheckChild: enmRequest=2 rc=-5600 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
170VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da
1712e44.2de0: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3)
1722e44.2de0: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
173VBoxDrvStub error: ntdll.dll: 4 differences between 0x14a050 and 0x14a053 in #5 (.da

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette