API tools faq
paste
Guest User

Untitled

a guest
Aug 1st, 2016
219
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 262.60 KB | None | 0 0
raw download clone embed print report
  1. f84.131c: Log file opened: 5.1.2r108956 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110
  2. f84.131c: \SystemRoot\System32\ntdll.dll:
  3. f84.131c: CreationTime: 2015-12-04T08:46:26.160637700Z
  4. f84.131c: LastWriteTime: 2013-08-29T02:16:35.515578000Z
  5. f84.131c: ChangeTime: 2015-12-04T08:46:26.196622200Z
  6. f84.131c: FileAttributes: 0x20
  7. f84.131c: Size: 0x1a6dc0
  8. f84.131c: NT Headers: 0xe0
  9. f84.131c: Timestamp: 0x521eaf24
  10. f84.131c: Machine: 0x8664 - amd64
  11. f84.131c: Timestamp: 0x521eaf24
  12. f84.131c: Image Version: 6.1
  13. f84.131c: SizeOfImage: 0x1a9000 (1740800)
  14. f84.131c: Resource Dir: 0x151000 LB 0x560d8
  15. f84.131c: ProductName: Microsoft® Windows® Operating System
  16. f84.131c: ProductVersion: 6.1.7601.18247
  17. f84.131c: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  18. f84.131c: FileDescription: NT Layer DLL
  19. f84.131c: \SystemRoot\System32\kernel32.dll:
  20. f84.131c: CreationTime: 2015-12-04T08:46:26.126856400Z
  21. f84.131c: LastWriteTime: 2012-11-30T05:41:07.621000000Z
  22. f84.131c: ChangeTime: 2015-12-04T08:46:26.159953100Z
  23. f84.131c: FileAttributes: 0x20
  24. f84.131c: Size: 0x11b800
  25. f84.131c: NT Headers: 0xe8
  26. f84.131c: Timestamp: 0x50b8479a
  27. f84.131c: Machine: 0x8664 - amd64
  28. f84.131c: Timestamp: 0x50b8479a
  29. f84.131c: Image Version: 6.1
  30. f84.131c: SizeOfImage: 0x11f000 (1175552)
  31. f84.131c: Resource Dir: 0x116000 LB 0x528
  32. f84.131c: ProductName: Microsoft® Windows® Operating System
  33. f84.131c: ProductVersion: 6.1.7601.18015
  34. f84.131c: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  35. f84.131c: FileDescription: Windows NT BASE API Client DLL
  36. f84.131c: \SystemRoot\System32\KernelBase.dll:
  37. f84.131c: CreationTime: 2015-12-04T08:46:26.198009200Z
  38. f84.131c: LastWriteTime: 2012-11-30T05:41:07.715000000Z
  39. f84.131c: ChangeTime: 2015-12-04T08:46:26.216739000Z
  40. f84.131c: FileAttributes: 0x20
  41. f84.131c: Size: 0x67a00
  42. f84.131c: NT Headers: 0xe8
  43. f84.131c: Timestamp: 0x50b8479b
  44. f84.131c: Machine: 0x8664 - amd64
  45. f84.131c: Timestamp: 0x50b8479b
  46. f84.131c: Image Version: 6.1
  47. f84.131c: SizeOfImage: 0x6b000 (438272)
  48. f84.131c: Resource Dir: 0x69000 LB 0x530
  49. f84.131c: ProductName: Microsoft® Windows® Operating System
  50. f84.131c: ProductVersion: 6.1.7601.18015
  51. f84.131c: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  52. f84.131c: FileDescription: Windows NT BASE API Client DLL
  53. f84.131c: \SystemRoot\System32\apisetschema.dll:
  54. f84.131c: CreationTime: 2015-12-04T08:45:57.235605000Z
  55. f84.131c: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  56. f84.131c: ChangeTime: 2015-12-04T08:45:57.236095000Z
  57. f84.131c: FileAttributes: 0x20
  58. f84.131c: Size: 0x1a00
  59. f84.131c: NT Headers: 0xc0
  60. f84.131c: Timestamp: 0x4a5bdeab
  61. f84.131c: Machine: 0x8664 - amd64
  62. f84.131c: Timestamp: 0x4a5bdeab
  63. f84.131c: Image Version: 6.1
  64. f84.131c: SizeOfImage: 0x50000 (327680)
  65. f84.131c: Resource Dir: 0x30000 LB 0x3f0
  66. f84.131c: ProductName: Microsoft® Windows® Operating System
  67. f84.131c: ProductVersion: 6.1.7600.16385
  68. f84.131c: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  69. f84.131c: FileDescription: ApiSet Schema DLL
  70. f84.131c: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  71. f84.131c: supR3HardenedWinFindAdversaries: 0x0
  72. f84.131c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  73. f84.131c: Calling main()
  74. f84.131c: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  75. f84.131c: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  76. f84.131c: SUPR3HardenedMain: Respawn #1
  77. f84.131c: System32: \Device\HarddiskVolume2\Windows\System32
  78. f84.131c: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  79. f84.131c: KnownDllPath: C:\Windows\system32
  80. f84.131c: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  81. f84.131c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  82. f84.131c: supR3HardNtEnableThreadCreation:
  83. f84.131c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00000000774bc340 pvNtTerminateThread=00000000774e17e0
  84. f84.131c: supR3HardenedWinDoReSpawn(1): New child bd0.4bc [kernel32].
  85. f84.131c: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdd000 cbPeb=0x380
  86. f84.131c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077490000 uNtDllChildAddr=0000000077490000
  87. f84.131c: supR3HardenedWinSetupChildInit: uLdrInitThunk=00000000774bc340
  88. f84.131c: supR3HardenedWinSetupChildInit: Start child.
  89. f84.131c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  90. f84.131c: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 33 sleeps
  91. f84.131c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  92. f84.131c: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
  93. f84.131c: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
  94. f84.131c: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
  95. f84.131c: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
  96. f84.131c: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
  97. f84.131c: 0000000000041000-ffffffffffef1fff 0x0001/0x0000 0x0000000
  98. f84.131c: *0000000000190000-0000000000093fff 0x0000/0x0004 0x0020000
  99. f84.131c: 000000000028c000-0000000000289fff 0x0104/0x0004 0x0020000
  100. f84.131c: 000000000028e000-000000000028bfff 0x0004/0x0004 0x0020000
  101. f84.131c: 0000000000290000-ffffffff8908ffff 0x0001/0x0000 0x0000000
  102. f84.131c: *0000000077490000-0000000077490fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  103. f84.131c: 0000000077491000-0000000077592fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  104. f84.131c: 0000000077593000-00000000775c1fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  105. f84.131c: 00000000775c2000-00000000775c9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  106. f84.131c: 00000000775ca000-00000000775cafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  107. f84.131c: 00000000775cb000-00000000775cdfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  108. f84.131c: 00000000775ce000-0000000077638fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  109. f84.131c: 0000000077639000-000000006fc91fff 0x0001/0x0000 0x0000000
  110. f84.131c: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
  111. f84.131c: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
  112. f84.131c: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
  113. f84.131c: 000000007fff0000-ffffffffc0e1ffff 0x0001/0x0000 0x0000000
  114. f84.131c: *000000013f1c0000-000000013f1c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  115. f84.131c: 000000013f1c1000-000000013f22ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  116. f84.131c: 000000013f230000-000000013f230fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  117. f84.131c: 000000013f231000-000000013f274fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  118. f84.131c: 000000013f275000-000000013f275fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  119. f84.131c: 000000013f276000-000000013f276fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  120. f84.131c: 000000013f277000-000000013f27bfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  121. f84.131c: 000000013f27c000-000000013f27cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  122. f84.131c: 000000013f27d000-000000013f27dfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  123. f84.131c: 000000013f27e000-000000013f281fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  124. f84.131c: 000000013f282000-000000013f2c9fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  125. f84.131c: 000000013f2ca000-fffff8037ede3fff 0x0001/0x0000 0x0000000
  126. f84.131c: *000007feff7b0000-000007feff7b0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  127. f84.131c: 000007feff7b1000-000007fdfefb1fff 0x0001/0x0000 0x0000000
  128. f84.131c: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
  129. f84.131c: 000007fffffd3000-000007fffffc8fff 0x0001/0x0000 0x0000000
  130. f84.131c: *000007fffffdd000-000007fffffdbfff 0x0004/0x0004 0x0020000
  131. f84.131c: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
  132. f84.131c: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
  133. f84.131c: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  134. f84.131c: VirtualBox.exe: timestamp 0x5790f053 (rc=VINF_SUCCESS)
  135. f84.131c: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  136. f84.131c: \Device\HarddiskVolume2\Windows\System32\apisetschema.dll: Owner is administrators group.
  137. f84.131c: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  138. f84.131c: \Device\HarddiskVolume2\Windows\System32\ntdll.dll: Owner is administrators group.
  139. f84.131c: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  140. f84.131c: supR3HardNtChildPurify: Done after 298 ms and 0 fixes (loop #0).
  141. bd0.4bc: Log file opened: 5.1.2r108956 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  142. bd0.4bc: supR3HardenedVmProcessInit: uNtDllAddr=0000000077490000 g_uNtVerCombined=0x611db100
  143. bd0.4bc: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
  144. bd0.4bc: New simple heap: #1 0000000000290000 LB 0x400000 (for 1740800 allocation)
  145. f84.131c: supR3HardNtEnableThreadCreation:
  146. bd0.4bc: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  147. bd0.4bc: System32: \Device\HarddiskVolume2\Windows\System32
  148. bd0.4bc: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  149. bd0.4bc: KnownDllPath: C:\Windows\system32
  150. bd0.4bc: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  151. bd0.4bc: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  152. bd0.4bc: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  153. bd0.4bc: Registered Dll notification callback with NTDLL.
  154. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\kernel32.dll: Owner is administrators group.
  155. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  156. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  157. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  158. bd0.4bc: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  159. bd0.4bc: supR3HardenedDllNotificationCallback: load 0000000077270000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  160. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  161. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007fefd720000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  162. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll: Owner is administrators group.
  163. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  164. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  165. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077270000 'C:\Windows\system32\kernel32.dll'
  166. bd0.4bc: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00000000774bc340 pvNtTerminateThread=00000000774e17e0
  167. f84.131c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 36 ms.
  168. bd0.4bc: \SystemRoot\System32\ntdll.dll:
  169. bd0.4bc: CreationTime: 2015-12-04T08:46:26.160637700Z
  170. bd0.4bc: LastWriteTime: 2013-08-29T02:16:35.515578000Z
  171. bd0.4bc: ChangeTime: 2015-12-04T08:46:26.196622200Z
  172. bd0.4bc: FileAttributes: 0x20
  173. bd0.4bc: Size: 0x1a6dc0
  174. bd0.4bc: NT Headers: 0xe0
  175. bd0.4bc: Timestamp: 0x521eaf24
  176. bd0.4bc: Machine: 0x8664 - amd64
  177. bd0.4bc: Timestamp: 0x521eaf24
  178. bd0.4bc: Image Version: 6.1
  179. bd0.4bc: SizeOfImage: 0x1a9000 (1740800)
  180. bd0.4bc: Resource Dir: 0x151000 LB 0x560d8
  181. bd0.4bc: ProductName: Microsoft® Windows® Operating System
  182. bd0.4bc: ProductVersion: 6.1.7601.18247
  183. bd0.4bc: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  184. bd0.4bc: FileDescription: NT Layer DLL
  185. bd0.4bc: \SystemRoot\System32\kernel32.dll:
  186. bd0.4bc: CreationTime: 2015-12-04T08:46:26.126856400Z
  187. bd0.4bc: LastWriteTime: 2012-11-30T05:41:07.621000000Z
  188. bd0.4bc: ChangeTime: 2015-12-04T08:46:26.159953100Z
  189. bd0.4bc: FileAttributes: 0x20
  190. bd0.4bc: Size: 0x11b800
  191. bd0.4bc: NT Headers: 0xe8
  192. bd0.4bc: Timestamp: 0x50b8479a
  193. bd0.4bc: Machine: 0x8664 - amd64
  194. bd0.4bc: Timestamp: 0x50b8479a
  195. bd0.4bc: Image Version: 6.1
  196. bd0.4bc: SizeOfImage: 0x11f000 (1175552)
  197. bd0.4bc: Resource Dir: 0x116000 LB 0x528
  198. bd0.4bc: ProductName: Microsoft® Windows® Operating System
  199. bd0.4bc: ProductVersion: 6.1.7601.18015
  200. bd0.4bc: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  201. bd0.4bc: FileDescription: Windows NT BASE API Client DLL
  202. bd0.4bc: \SystemRoot\System32\KernelBase.dll:
  203. bd0.4bc: CreationTime: 2015-12-04T08:46:26.198009200Z
  204. bd0.4bc: LastWriteTime: 2012-11-30T05:41:07.715000000Z
  205. bd0.4bc: ChangeTime: 2015-12-04T08:46:26.216739000Z
  206. bd0.4bc: FileAttributes: 0x20
  207. bd0.4bc: Size: 0x67a00
  208. bd0.4bc: NT Headers: 0xe8
  209. bd0.4bc: Timestamp: 0x50b8479b
  210. bd0.4bc: Machine: 0x8664 - amd64
  211. bd0.4bc: Timestamp: 0x50b8479b
  212. bd0.4bc: Image Version: 6.1
  213. bd0.4bc: SizeOfImage: 0x6b000 (438272)
  214. bd0.4bc: Resource Dir: 0x69000 LB 0x530
  215. bd0.4bc: ProductName: Microsoft® Windows® Operating System
  216. bd0.4bc: ProductVersion: 6.1.7601.18015
  217. bd0.4bc: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  218. bd0.4bc: FileDescription: Windows NT BASE API Client DLL
  219. bd0.4bc: \SystemRoot\System32\apisetschema.dll:
  220. bd0.4bc: CreationTime: 2015-12-04T08:45:57.235605000Z
  221. bd0.4bc: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  222. bd0.4bc: ChangeTime: 2015-12-04T08:45:57.236095000Z
  223. bd0.4bc: FileAttributes: 0x20
  224. bd0.4bc: Size: 0x1a00
  225. bd0.4bc: NT Headers: 0xc0
  226. bd0.4bc: Timestamp: 0x4a5bdeab
  227. bd0.4bc: Machine: 0x8664 - amd64
  228. bd0.4bc: Timestamp: 0x4a5bdeab
  229. bd0.4bc: Image Version: 6.1
  230. bd0.4bc: SizeOfImage: 0x50000 (327680)
  231. bd0.4bc: Resource Dir: 0x30000 LB 0x3f0
  232. bd0.4bc: ProductName: Microsoft® Windows® Operating System
  233. bd0.4bc: ProductVersion: 6.1.7600.16385
  234. bd0.4bc: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  235. bd0.4bc: FileDescription: ApiSet Schema DLL
  236. bd0.4bc: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  237. bd0.4bc: supR3HardenedWinFindAdversaries: 0x0
  238. bd0.4bc: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  239. bd0.4bc: Calling main()
  240. bd0.4bc: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  241. bd0.4bc: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  242. bd0.4bc: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  243. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  244. bd0.4bc: SUPR3HardenedMain: Respawn #2
  245. bd0.4bc: supR3HardNtEnableThreadCreation:
  246. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\advapi32.dll: Owner is administrators group.
  247. bd0.4bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  248. bd0.4bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  249. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
  250. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  251. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  252. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  253. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll: Owner is administrators group.
  254. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
  255. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  256. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  257. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  258. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll: Owner is administrators group.
  259. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
  260. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  261. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x1000 pwszSearchPath=0000000000000000:<flags> [calling]
  262. bd0.4bc: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  263. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007fefe400000 LB 0x000db000 C:\Windows\system32\ADVAPI32.DLL [fFlags=0x0]
  264. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  265. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007fefe360000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
  266. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  267. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\sechost.dll: Owner is administrators group.
  268. bd0.4bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  269. bd0.4bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  270. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
  271. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
  272. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007fefe340000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  273. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  274. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007feff5f0000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  275. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  276. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe400000 'C:\Windows\system32\ADVAPI32.DLL'
  277. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\apphelp.dll: Owner is administrators group.
  278. bd0.4bc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
  279. bd0.4bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  280. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  281. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  282. bd0.4bc: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  283. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  284. bd0.4bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  285. bd0.4bc: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  286. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  287. bd0.4bc: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  288. bd0.4bc: supR3HardenedDllNotificationCallback: load 000007fefd2b0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
  289. bd0.4bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  290. bd0.4bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd2b0000 'C:\Windows\system32\apphelp.dll'
  291. bd0.4bc: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00000000774bc340 pvNtTerminateThread=00000000774e17e0
  292. bd0.4bc: supR3HardenedWinDoReSpawn(2): New child 6ac.874 [kernel32].
  293. bd0.4bc: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd7000 cbPeb=0x380
  294. bd0.4bc: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077490000 uNtDllChildAddr=0000000077490000
  295. bd0.4bc: supR3HardenedWinSetupChildInit: uLdrInitThunk=00000000774bc340
  296. bd0.4bc: supR3HardenedWinSetupChildInit: Start child.
  297. bd0.4bc: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  298. bd0.4bc: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 33 sleeps
  299. bd0.4bc: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  300. bd0.4bc: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
  301. bd0.4bc: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
  302. bd0.4bc: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
  303. bd0.4bc: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
  304. bd0.4bc: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
  305. bd0.4bc: 0000000000041000-ffffffffffe71fff 0x0001/0x0000 0x0000000
  306. bd0.4bc: *0000000000210000-0000000000113fff 0x0000/0x0004 0x0020000
  307. bd0.4bc: 000000000030c000-0000000000309fff 0x0104/0x0004 0x0020000
  308. bd0.4bc: 000000000030e000-000000000030bfff 0x0004/0x0004 0x0020000
  309. bd0.4bc: 0000000000310000-ffffffff8918ffff 0x0001/0x0000 0x0000000
  310. bd0.4bc: *0000000077490000-0000000077490fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  311. bd0.4bc: 0000000077491000-0000000077592fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  312. bd0.4bc: 0000000077593000-00000000775c1fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  313. bd0.4bc: 00000000775c2000-00000000775c9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  314. bd0.4bc: 00000000775ca000-00000000775cafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  315. bd0.4bc: 00000000775cb000-00000000775cdfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  316. bd0.4bc: 00000000775ce000-0000000077638fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  317. bd0.4bc: 0000000077639000-000000006fc91fff 0x0001/0x0000 0x0000000
  318. bd0.4bc: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
  319. bd0.4bc: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
  320. bd0.4bc: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
  321. bd0.4bc: 000000007fff0000-ffffffffc0e1ffff 0x0001/0x0000 0x0000000
  322. bd0.4bc: *000000013f1c0000-000000013f1c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  323. bd0.4bc: 000000013f1c1000-000000013f22ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  324. bd0.4bc: 000000013f230000-000000013f230fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  325. bd0.4bc: 000000013f231000-000000013f274fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  326. bd0.4bc: 000000013f275000-000000013f275fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  327. bd0.4bc: 000000013f276000-000000013f276fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  328. bd0.4bc: 000000013f277000-000000013f27bfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  329. bd0.4bc: 000000013f27c000-000000013f27cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  330. bd0.4bc: 000000013f27d000-000000013f27dfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  331. bd0.4bc: 000000013f27e000-000000013f281fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  332. bd0.4bc: 000000013f282000-000000013f2c9fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  333. bd0.4bc: 000000013f2ca000-fffff8037ede3fff 0x0001/0x0000 0x0000000
  334. bd0.4bc: *000007feff7b0000-000007feff7b0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  335. bd0.4bc: 000007feff7b1000-000007fdfefb1fff 0x0001/0x0000 0x0000000
  336. bd0.4bc: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
  337. bd0.4bc: 000007fffffd3000-000007fffffcefff 0x0001/0x0000 0x0000000
  338. bd0.4bc: *000007fffffd7000-000007fffffd5fff 0x0004/0x0004 0x0020000
  339. bd0.4bc: 000007fffffd8000-000007fffffd1fff 0x0001/0x0000 0x0000000
  340. bd0.4bc: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
  341. bd0.4bc: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
  342. bd0.4bc: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  343. bd0.4bc: VirtualBox.exe: timestamp 0x5790f053 (rc=VINF_SUCCESS)
  344. bd0.4bc: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  345. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\apisetschema.dll: Owner is administrators group.
  346. bd0.4bc: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  347. bd0.4bc: \Device\HarddiskVolume2\Windows\System32\ntdll.dll: Owner is administrators group.
  348. bd0.4bc: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  349. bd0.4bc: supR3HardNtChildPurify: Done after 292 ms and 0 fixes (loop #0).
  350. 6ac.874: Log file opened: 5.1.2r108956 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  351. 6ac.874: supR3HardenedVmProcessInit: uNtDllAddr=0000000077490000 g_uNtVerCombined=0x611db100
  352. bd0.4bc: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000290000 LB 0x400000)
  353. 6ac.874: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
  354. bd0.4bc: supR3HardNtEnableThreadCreation:
  355. 6ac.874: New simple heap: #1 0000000000310000 LB 0x400000 (for 1740800 allocation)
  356. 6ac.874: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  357. 6ac.874: System32: \Device\HarddiskVolume2\Windows\System32
  358. 6ac.874: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  359. 6ac.874: KnownDllPath: C:\Windows\system32
  360. 6ac.874: supR3HardenedVmProcessInit: Opening vboxdrv...
  361. 6ac.874: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  362. 6ac.874: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  363. 6ac.874: Registered Dll notification callback with NTDLL.
  364. 6ac.874: \Device\HarddiskVolume2\Windows\System32\kernel32.dll: Owner is administrators group.
  365. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  366. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  367. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  368. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  369. 6ac.874: supR3HardenedDllNotificationCallback: load 0000000077270000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  370. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  371. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd720000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  372. 6ac.874: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll: Owner is administrators group.
  373. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  374. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  375. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077270000 'C:\Windows\system32\kernel32.dll'
  376. 6ac.874: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00000000774bc340 pvNtTerminateThread=00000000774e17e0
  377. bd0.4bc: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 33 ms.
  378. 6ac.874: \SystemRoot\System32\ntdll.dll:
  379. 6ac.874: CreationTime: 2015-12-04T08:46:26.160637700Z
  380. 6ac.874: LastWriteTime: 2013-08-29T02:16:35.515578000Z
  381. 6ac.874: ChangeTime: 2015-12-04T08:46:26.196622200Z
  382. 6ac.874: FileAttributes: 0x20
  383. 6ac.874: Size: 0x1a6dc0
  384. 6ac.874: NT Headers: 0xe0
  385. 6ac.874: Timestamp: 0x521eaf24
  386. 6ac.874: Machine: 0x8664 - amd64
  387. 6ac.874: Timestamp: 0x521eaf24
  388. 6ac.874: Image Version: 6.1
  389. 6ac.874: SizeOfImage: 0x1a9000 (1740800)
  390. 6ac.874: Resource Dir: 0x151000 LB 0x560d8
  391. 6ac.874: ProductName: Microsoft® Windows® Operating System
  392. 6ac.874: ProductVersion: 6.1.7601.18247
  393. 6ac.874: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  394. 6ac.874: FileDescription: NT Layer DLL
  395. 6ac.874: \SystemRoot\System32\kernel32.dll:
  396. 6ac.874: CreationTime: 2015-12-04T08:46:26.126856400Z
  397. 6ac.874: LastWriteTime: 2012-11-30T05:41:07.621000000Z
  398. 6ac.874: ChangeTime: 2015-12-04T08:46:26.159953100Z
  399. 6ac.874: FileAttributes: 0x20
  400. 6ac.874: Size: 0x11b800
  401. 6ac.874: NT Headers: 0xe8
  402. 6ac.874: Timestamp: 0x50b8479a
  403. 6ac.874: Machine: 0x8664 - amd64
  404. 6ac.874: Timestamp: 0x50b8479a
  405. 6ac.874: Image Version: 6.1
  406. 6ac.874: SizeOfImage: 0x11f000 (1175552)
  407. 6ac.874: Resource Dir: 0x116000 LB 0x528
  408. 6ac.874: ProductName: Microsoft® Windows® Operating System
  409. 6ac.874: ProductVersion: 6.1.7601.18015
  410. 6ac.874: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  411. 6ac.874: FileDescription: Windows NT BASE API Client DLL
  412. 6ac.874: \SystemRoot\System32\KernelBase.dll:
  413. 6ac.874: CreationTime: 2015-12-04T08:46:26.198009200Z
  414. 6ac.874: LastWriteTime: 2012-11-30T05:41:07.715000000Z
  415. 6ac.874: ChangeTime: 2015-12-04T08:46:26.216739000Z
  416. 6ac.874: FileAttributes: 0x20
  417. 6ac.874: Size: 0x67a00
  418. 6ac.874: NT Headers: 0xe8
  419. 6ac.874: Timestamp: 0x50b8479b
  420. 6ac.874: Machine: 0x8664 - amd64
  421. 6ac.874: Timestamp: 0x50b8479b
  422. 6ac.874: Image Version: 6.1
  423. 6ac.874: SizeOfImage: 0x6b000 (438272)
  424. 6ac.874: Resource Dir: 0x69000 LB 0x530
  425. 6ac.874: ProductName: Microsoft® Windows® Operating System
  426. 6ac.874: ProductVersion: 6.1.7601.18015
  427. 6ac.874: FileVersion: 6.1.7601.18015 (win7sp1_gdr.121129-1432)
  428. 6ac.874: FileDescription: Windows NT BASE API Client DLL
  429. 6ac.874: \SystemRoot\System32\apisetschema.dll:
  430. 6ac.874: CreationTime: 2015-12-04T08:45:57.235605000Z
  431. 6ac.874: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  432. 6ac.874: ChangeTime: 2015-12-04T08:45:57.236095000Z
  433. 6ac.874: FileAttributes: 0x20
  434. 6ac.874: Size: 0x1a00
  435. 6ac.874: NT Headers: 0xc0
  436. 6ac.874: Timestamp: 0x4a5bdeab
  437. 6ac.874: Machine: 0x8664 - amd64
  438. 6ac.874: Timestamp: 0x4a5bdeab
  439. 6ac.874: Image Version: 6.1
  440. 6ac.874: SizeOfImage: 0x50000 (327680)
  441. 6ac.874: Resource Dir: 0x30000 LB 0x3f0
  442. 6ac.874: ProductName: Microsoft® Windows® Operating System
  443. 6ac.874: ProductVersion: 6.1.7600.16385
  444. 6ac.874: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  445. 6ac.874: FileDescription: ApiSet Schema DLL
  446. 6ac.874: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  447. 6ac.874: supR3HardenedWinFindAdversaries: 0x0
  448. 6ac.874: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  449. 6ac.874: Calling main()
  450. 6ac.874: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  451. 6ac.874: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  452. 6ac.874: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  453. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  454. 6ac.874: SUPR3HardenedMain: Final process, opening VBoxDrv...
  455. 6ac.874: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000310000 LB 0x400000)
  456. 6ac.874: supR3HardNtEnableThreadCreation:
  457. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  458. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  459. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008743e0:C:\Windows\system32 [calling]
  460. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  461. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fef28d0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  462. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  463. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  464. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  465. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef28d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  466. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  467. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  468. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef28d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  469. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef28d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  470. 6ac.874: \Device\HarddiskVolume2\Windows\System32\wintrust.dll: Owner is administrators group.
  471. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  472. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
  473. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  474. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  475. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
  476. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  477. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  478. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  479. 6ac.874: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll: Owner is administrators group.
  480. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
  481. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  482. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  483. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  484. 6ac.874: \Device\HarddiskVolume2\Windows\System32\msasn1.dll: Owner is administrators group.
  485. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
  486. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
  487. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  488. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  489. 6ac.874: \Device\HarddiskVolume2\Windows\System32\crypt32.dll: Owner is administrators group.
  490. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  491. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  492. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
  493. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  494. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  495. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  496. 6ac.874: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll: Owner is administrators group.
  497. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
  498. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  499. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  500. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  501. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  502. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  503. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  504. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  505. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008743e0:C:\Windows\system32 [calling]
  506. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  507. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd570000 LB 0x0003a000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
  508. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  509. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe360000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
  510. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  511. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd5b0000 LB 0x00167000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
  512. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  513. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd480000 LB 0x0000f000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
  514. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  515. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feff5f0000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  516. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  517. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd570000 'C:\Windows\system32\Wintrust.dll'
  518. 6ac.874: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll: Owner is administrators group.
  519. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
  520. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  521. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008b9a00:C:\Windows\system32 [calling]
  522. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  523. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefcde0000 LB 0x00022000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
  524. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  525. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcde0000 'C:\Windows\system32\bcrypt.dll'
  526. 6ac.874: bcrypt.dll loaded at 000007fefcde0000, BCryptOpenAlgorithmProvider at 000007fefcde2640, preloading providers:
  527. 6ac.874: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll: Owner is administrators group.
  528. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  529. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
  530. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
  531. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
  532. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  533. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  534. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  535. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  536. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  537. 6ac.874: \Device\HarddiskVolume2\Windows\System32\advapi32.dll: Owner is administrators group.
  538. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  539. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  540. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
  541. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  542. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  543. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  544. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  545. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  546. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  547. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  548. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  549. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  550. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefc8e0000 LB 0x0004c000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
  551. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  552. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe400000 LB 0x000db000 C:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
  553. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  554. 6ac.874: \Device\HarddiskVolume2\Windows\System32\sechost.dll: Owner is administrators group.
  555. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  556. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  557. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
  558. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
  559. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe340000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  560. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  561. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc8e0000 'C:\Windows\system32\bcryptprimitives.dll'
  562. 6ac.874: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000008bb0e0)
  563. 6ac.874: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000008bdfa0)
  564. 6ac.874: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=00000000008be0c0)
  565. 6ac.874: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=00000000008be2d0)
  566. 6ac.874: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=00000000008be3f0)
  567. 6ac.874: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000008be510)
  568. 6ac.874: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000008be750)
  569. 6ac.874: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=00000000008be870)
  570. 6ac.874: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll: Owner is administrators group.
  571. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
  572. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  573. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  574. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  575. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  576. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  577. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  578. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  579. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  580. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  581. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefcea0000 LB 0x00017000 C:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
  582. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  583. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcea0000 'C:\Windows\system32\CRYPTSP.dll'
  584. 6ac.874: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll: Owner is administrators group.
  585. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  586. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
  587. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
  588. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  589. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  590. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  591. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  592. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  593. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefc9b0000 LB 0x00047000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
  594. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  595. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc9b0000 'C:\Windows\system32\rsaenh.dll'
  596. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  597. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  598. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe400000 'C:\Windows\system32\ADVAPI32.dll'
  599. 6ac.874: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll: Owner is administrators group.
  600. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
  601. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  602. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  603. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  604. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd310000 LB 0x0000f000 C:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
  605. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  606. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd310000 'C:\Windows\system32\CRYPTBASE.dll'
  607. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  608. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  609. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077270000 'C:\Windows\system32\kernel32.dll'
  610. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  611. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  612. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd570000 'C:\Windows\system32\WINTRUST.DLL'
  613. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  614. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  615. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd5b0000 'C:\Windows\system32\CRYPT32.dll'
  616. 6ac.874: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll: Owner is administrators group.
  617. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  618. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
  619. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  620. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  621. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  622. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  623. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imagehlp.dll (Input=imagehlp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  624. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  625. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe840000 LB 0x00017000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
  626. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  627. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe840000 'C:\Windows\system32\imagehlp.dll'
  628. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  629. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  630. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcea0000 'C:\Windows\system32\CRYPTSP.dll'
  631. 6ac.874: \Device\HarddiskVolume2\Windows\System32\user32.dll: Owner is administrators group.
  632. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  633. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
  634. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
  635. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  636. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  637. 6ac.874: \Device\HarddiskVolume2\Windows\System32\gdi32.dll: Owner is administrators group.
  638. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  639. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
  640. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
  641. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  642. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
  643. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume2\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
  644. 6ac.874: \Device\HarddiskVolume2\Windows\System32\lpk.dll: Owner is administrators group.
  645. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  646. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  647. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
  648. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\lpk.dll)
  649. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\lpk.dll
  650. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  651. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  652. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  653. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
  654. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume2\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
  655. 6ac.874: \Device\HarddiskVolume2\Windows\System32\usp10.dll: Owner is administrators group.
  656. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  657. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  658. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  659. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\usp10.dll)
  660. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\usp10.dll
  661. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  662. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  663. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  664. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  665. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  666. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  667. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  668. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  669. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  670. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  671. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  672. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  673. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  674. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  675. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  676. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USER32.dll (Input=USER32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  677. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  678. 6ac.874: supR3HardenedDllNotificationCallback: load 0000000077390000 LB 0x000fa000 C:\Windows\system32\USER32.dll [fFlags=0x0]
  679. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  680. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe650000 LB 0x00067000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
  681. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  682. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe1b0000 LB 0x0000e000 C:\Windows\system32\LPK.dll [fFlags=0x0]
  683. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\lpk.dll [lacks WinVerifyTrust]
  684. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe4e0000 LB 0x000c9000 C:\Windows\system32\USP10.dll [fFlags=0x0]
  685. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\usp10.dll [lacks WinVerifyTrust]
  686. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  687. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  688. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe650000 'C:\Windows\system32\gdi32.dll'
  689. 6ac.874: \Device\HarddiskVolume2\Windows\System32\imm32.dll: Owner is administrators group.
  690. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  691. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  692. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
  693. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
  694. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
  695. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
  696. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
  697. 6ac.874: \Device\HarddiskVolume2\Windows\System32\msctf.dll: Owner is administrators group.
  698. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  699. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  700. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  701. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
  702. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
  703. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
  704. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  705. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  706. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  707. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  708. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  709. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  710. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  711. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  712. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  713. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  714. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  715. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  716. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  717. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  718. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  719. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  720. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  721. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  722. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  723. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  724. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefda90000 LB 0x0002e000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
  725. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  726. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdec0000 LB 0x00109000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
  727. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [lacks WinVerifyTrust]
  728. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefda90000 'C:\Windows\system32\IMM32.DLL'
  729. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077390000 'C:\Windows\system32\USER32.dll'
  730. 6ac.874: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll: Owner is administrators group.
  731. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
  732. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  733. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
  734. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ncrypt.dll)
  735. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  736. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  737. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  738. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  739. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  740. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  741. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  742. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  743. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  744. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  745. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ncrypt.dll (Input=ncrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  746. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  747. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefce10000 LB 0x0004e000 C:\Windows\system32\ncrypt.dll [fFlags=0x0]
  748. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  749. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefce10000 'C:\Windows\system32\ncrypt.dll'
  750. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  751. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (Input=bcrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  752. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcde0000 'C:\Windows\system32\bcrypt.dll'
  753. 6ac.874: \Device\HarddiskVolume2\Windows\System32\userenv.dll: Owner is administrators group.
  754. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  755. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  756. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
  757. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\userenv.dll)
  758. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
  759. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  760. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  761. 6ac.874: \Device\HarddiskVolume2\Windows\System32\profapi.dll: Owner is administrators group.
  762. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  763. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
  764. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
  765. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  766. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  767. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  768. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  769. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  770. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  771. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  772. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  773. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  774. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USERENV.dll (Input=USERENV.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  775. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  776. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefc720000 LB 0x0001e000 C:\Windows\system32\USERENV.dll [fFlags=0x0]
  777. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  778. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  779. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd3e0000 LB 0x0000f000 C:\Windows\system32\profapi.dll [fFlags=0x0]
  780. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  781. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc720000 'C:\Windows\system32\USERENV.dll'
  782. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  783. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  784. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  785. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  786. 6ac.874: \Device\HarddiskVolume2\Windows\System32\gpapi.dll: Owner is administrators group.
  787. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  788. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  789. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
  790. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
  791. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  792. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  793. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  794. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  795. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  796. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  797. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\GPAPI.dll (Input=GPAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  798. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  799. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefc700000 LB 0x0001b000 C:\Windows\system32\GPAPI.dll [fFlags=0x0]
  800. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  801. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc700000 'C:\Windows\system32\GPAPI.dll'
  802. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  803. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  804. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  805. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  806. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff5f0000 'C:\Windows\system32\rpcrt4.dll'
  807. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  808. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-WIN-Service-Management-L2-1-0.dll'
  809. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  810. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  811. 6ac.874: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll: Owner is administrators group.
  812. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  813. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'crypt32.dll'.
  814. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'wldap32.dll'.
  815. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
  816. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  817. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
  818. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
  819. 6ac.874: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll: Owner is administrators group.
  820. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  821. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\Wldap32.dll)
  822. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  823. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  824. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  825. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  826. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  827. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  828. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  829. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  830. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  831. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  832. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  833. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  834. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feef780000 LB 0x00026000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
  835. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  836. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefddc0000 LB 0x00052000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
  837. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
  838. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  839. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  840. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  841. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  842. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  843. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  844. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  845. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  846. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  847. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  848. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  849. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  850. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  851. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  852. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  853. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  854. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  855. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  856. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  857. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  858. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  859. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  860. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  861. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  862. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  863. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  864. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  865. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  866. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  867. 6ac.874: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll: Owner is administrators group.
  868. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  869. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  870. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  871. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
  872. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  873. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  874. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  875. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  876. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  877. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  878. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  879. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  880. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  881. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  882. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHLWAPI.dll (Input=SHLWAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  883. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  884. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feff720000 LB 0x00071000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
  885. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  886. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff720000 'C:\Windows\system32\SHLWAPI.dll'
  887. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  888. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  889. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  890. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  891. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd3e0000 'C:\Windows\system32\profapi.dll'
  892. 6ac.874: \Device\HarddiskVolume2\Windows\System32\setupapi.dll: Owner is administrators group.
  893. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'cfgmgr32.dll'.
  894. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcrt.dll'.
  895. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
  896. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  897. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  898. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  899. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'devobj.dll'.
  900. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll)
  901. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  902. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  903. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  904. 6ac.874: \Device\HarddiskVolume2\Windows\System32\devobj.dll: Owner is administrators group.
  905. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  906. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'cfgmgr32.dll'.
  907. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devobj.dll)
  908. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
  909. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  910. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  911. 6ac.874: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll: Owner is administrators group.
  912. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  913. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  914. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  915. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  916. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  917. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll)
  918. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  919. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  920. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  921. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  922. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  923. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  924. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  925. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  926. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  927. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  928. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  929. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  930. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  931. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  932. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  933. 6ac.874: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll: Owner is administrators group.
  934. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  935. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
  936. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  937. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll)
  938. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  939. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  940. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  941. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  942. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  943. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  944. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  945. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  946. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  947. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  948. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  949. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  950. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  951. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  952. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  953. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  954. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  955. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  956. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  957. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  958. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  959. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  960. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  961. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  962. 6ac.874: \Device\HarddiskVolume2\Windows\System32\ole32.dll: Owner is administrators group.
  963. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  964. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  965. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
  966. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  967. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ole32.dll)
  968. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
  969. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  970. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  971. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  972. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  973. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  974. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  975. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  976. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  977. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  978. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  979. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  980. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  981. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  982. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  983. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  984. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  985. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  986. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  987. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\setupapi.dll (Input=setupapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  988. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  989. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdfd0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [fFlags=0x0]
  990. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  991. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd490000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  992. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  993. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdac0000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  994. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll [lacks WinVerifyTrust]
  995. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdba0000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  996. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ole32.dll [lacks WinVerifyTrust]
  997. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd790000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  998. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [lacks WinVerifyTrust]
  999. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1000. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077270000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  1001. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdfd0000 'C:\Windows\system32\setupapi.dll'
  1002. 6ac.874: \Device\HarddiskVolume2\Windows\System32\cabinet.dll: Owner is administrators group.
  1003. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1004. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cabinet.dll)
  1005. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1006. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1007. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1008. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1009. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Cabinet.dll (Input=Cabinet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1010. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1011. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fef4cf0000 LB 0x0001b000 C:\Windows\system32\Cabinet.dll [fFlags=0x0]
  1012. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1013. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4cf0000 'C:\Windows\system32\Cabinet.dll'
  1014. 6ac.874: \Device\HarddiskVolume2\Windows\System32\devrtl.dll: Owner is administrators group.
  1015. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1016. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devrtl.dll)
  1017. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1018. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1019. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1020. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1021. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\DEVRTL.dll (Input=DEVRTL.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1022. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1023. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefc740000 LB 0x00012000 C:\Windows\system32\DEVRTL.dll [fFlags=0x0]
  1024. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1025. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc740000 'C:\Windows\system32\DEVRTL.dll'
  1026. 6ac.874: supR3HardenedDllNotificationCallback: Unload 000007fefdfd0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [flags=0x0]
  1027. 6ac.874: supR3HardenedDllNotificationCallback: Unload 000007fefd790000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [flags=0x0]
  1028. 6ac.874: supR3HardenedDllNotificationCallback: Unload 000007fefdac0000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [flags=0x0]
  1029. 6ac.874: supR3HardenedDllNotificationCallback: Unload 000007fefdba0000 LB 0x00203000 C:\Windows\system32\ole32.dll [flags=0x0]
  1030. 6ac.874: supR3HardenedDllNotificationCallback: Unload 000007fefd490000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [flags=0x0]
  1031. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1032. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feef780000 'C:\Windows\system32\cryptnet.dll'
  1033. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  1034. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008b5c10
  1035. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1036. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=771D512B7B1C39F0393BD4EF9FC62F442783FB35
  1037. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1038. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1039. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1040. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1041. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1042. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
  1043. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1044. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1045. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe400000 'C:\Windows\system32\ADVAPI32.dll'
  1046. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1047. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1048. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1049. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe340000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1050. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\SystemRoot\System32\ntdll.dll'
  1051. 6ac.874: g_pfnWinVerifyTrust=000007fefd571010
  1052. 6ac.874: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  1053. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e0 pwszName=\Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1054. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1055. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1056. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=766DAE0DAEDFFD0DB96611658C619DD5922D2FEC
  1057. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1058. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1059. 6ac.874: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1060. 6ac.874: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  1061. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d4 pwszName=\Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1062. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1063. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1064. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E8D9B442D9CC38B2D0501106E104A42A4EE0B238
  1065. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1066. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1067. 6ac.874: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1068. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003ec pwszName=\Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1069. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1070. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1071. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=445E5B0E9F43B5D56A5B9C4BC3369E3D076ACA1A
  1072. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1073. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1074. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1075. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e0 pwszName=\Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1076. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1077. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1078. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5D1555851298EA005A2E9FEA027F5898BC240083
  1079. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1080. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1081. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1082. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a8 pwszName=\Device\HarddiskVolume2\Windows\System32\ole32.dll
  1083. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1084. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1085. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E64AE329BD5124592BC8CB0B327AA3B95DC65B7
  1086. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1087. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1088. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1089. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a4 pwszName=\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1090. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1091. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1092. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8F731777EFC4BC982C1E1467FBF29A74CC14D93A
  1093. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1094. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1095. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1096. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a0 pwszName=\Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1097. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1098. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1099. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=26A5C3FE898CBD66951D3BC65E742E0BE561E69B
  1100. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1101. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1102. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1103. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000039c pwszName=\Device\HarddiskVolume2\Windows\System32\devobj.dll
  1104. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1105. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1106. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B410A095222E69F0ECE7D66E4AC27A7125D2EB5A
  1107. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1108. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1109. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1110. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000398 pwszName=\Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1111. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1112. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1113. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1499C4FEA6E143F9BEC35B4FFA098917D3A6EBF2
  1114. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1115. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1116. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1117. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000038c pwszName=\Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1118. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1119. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1120. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB8D9C9D3E1FC95D01F9A984B16ED031BB40CD8
  1121. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1122. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1123. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1124. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000380 pwszName=\Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1125. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1126. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1127. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87E73086F2528CF31D3AD5F0D71E04F8B942D5D8
  1128. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1129. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1130. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1131. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000037c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1132. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1133. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1134. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CA2FE16E05087DA5C24DC5EB2EE8053CDA5DE9A9
  1135. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1136. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1137. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1138. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000258 pwszName=\Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1139. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1140. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1141. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=470795C189226F7BDB8E50F42104CC34488B9340
  1142. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1143. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1144. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1145. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c4 pwszName=\Device\HarddiskVolume2\Windows\System32\profapi.dll
  1146. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1147. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1148. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
  1149. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1150. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1151. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1152. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c0 pwszName=\Device\HarddiskVolume2\Windows\System32\userenv.dll
  1153. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1154. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1155. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3E1A2CC7367F751C19EBF4E6EDF5E9A10E47313
  1156. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1157. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1158. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1159. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001ac pwszName=\Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1160. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1161. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1162. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3D482C50075646C922DC6A66C97956C5060C361B
  1163. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1164. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1165. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1166. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000194 pwszName=\Device\HarddiskVolume2\Windows\System32\msctf.dll
  1167. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1168. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1169. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=803AF52F95A9EFDFDA06C595023831EE36ACD3A8
  1170. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1171. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1172. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1173. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000190 pwszName=\Device\HarddiskVolume2\Windows\System32\imm32.dll
  1174. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1175. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1176. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6EEE1AB3B6D79AFF857940FF5F51ED27698153EC
  1177. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1178. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1179. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1180. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000018c pwszName=\Device\HarddiskVolume2\Windows\System32\usp10.dll
  1181. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1182. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1183. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=97AE9B5B40144F2794F30A891013393C80D631A1
  1184. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1185. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1186. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1187. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000188 pwszName=\Device\HarddiskVolume2\Windows\System32\lpk.dll
  1188. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1189. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1190. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A42DFBB8A3A26D2178D79D34DA1CE275E2A0BE37
  1191. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1192. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1193. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1194. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000184 pwszName=\Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1195. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1196. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1197. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C8F7179D2AEB0FEB168A01D182223AC2D7B8F331
  1198. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1199. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1200. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1201. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000180 pwszName=\Device\HarddiskVolume2\Windows\System32\user32.dll
  1202. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1203. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1204. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1205. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1206. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008b5c10
  1207. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1208. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1209. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1210. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1211. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: -22900 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
  1212. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1213. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1214. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1215. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AFE89CF1060867A10BD3963894BCDB4D3058F804
  1216. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1217. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1218. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1219. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000130 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1220. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1221. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1222. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A965CC5DB13A5FB23BBB1B6B5FA6D400DC49462F
  1223. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1224. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1225. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1226. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
  1227. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000012c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  1228. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1229. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1230. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=40667EDBA9045D4A4BE1D4844665D3B88F8CD0E0
  1231. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1232. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1233. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1234. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000120 pwszName=\Device\HarddiskVolume2\Windows\System32\sechost.dll
  1235. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1236. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1237. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3FA2A014BF360CDC0E203A174FFC9DC5343C5323
  1238. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1239. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1240. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1241. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000011c pwszName=\Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1242. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1243. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1244. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7C0A1C638CE7C1160F49C473EC1420BD3AB693C4
  1245. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1246. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1247. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1248. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
  1249. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  1250. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1251. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1252. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62E377A1F0AD0C2EDC0A73CB3EFF841FF18D00D2
  1253. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1254. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1255. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1256. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e4 pwszName=\Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1257. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1258. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1259. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DBEAC8C0FA88C88B540ACFE0683B1810C077AA53
  1260. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1261. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1262. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1263. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000dc pwszName=\Device\HarddiskVolume2\Windows\System32\msasn1.dll
  1264. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1265. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1266. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F2FF57DC30D774F93061607060DAA0DD15E39CCE
  1267. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1268. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1269. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1270. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d8 pwszName=\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1271. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1272. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1273. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BC4D9E909DFDD2EE8BA1A5C857D73D49EBE7952C
  1274. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1275. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1276. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1277. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1278. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  1279. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1280. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1281. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=91F085E8EC8E74411F756DB12A25CCD01E5A5A34
  1282. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1283. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1284. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1285. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume2\Windows\System32\kernel32.dll
  1286. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1287. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1288. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8E81B4259AE0A9FFEFEA6E84E77A5D1659D68AE4
  1289. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1290. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1291. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1292. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1293. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008d0d20:C:\Windows\system32 [calling]
  1294. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd5b0000 'C:\Windows\system32\crypt32.dll'
  1295. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1296. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1297. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1298. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1299. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1300. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1301. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
  1302. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1303. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  1304. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  1305. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  1306. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1307. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1308. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  1309. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  1310. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  1311. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1312. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  1313. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1314. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1315. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1316. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1317. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1318. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
  1319. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  1320. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1321. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1322. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x35f812d09650dc00 C=FR, O=Certplus, CN=Class 2 Primary CA
  1323. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, [email protected]
  1324. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  1325. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1326. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  1327. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1328. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1329. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  1330. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  1331. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  1332. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  1333. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1334. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  1335. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1336. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xe66b56ffc86e50a4 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA, [email protected]
  1337. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  1338. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1339. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xa8b43f38c3f7b100 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware
  1340. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  1341. 6ac.874: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1342. 6ac.874: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=47
  1343. 6ac.874: SUPR3HardenedMain: Load Runtime...
  1344. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1345. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1346. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  1347. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  1348. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  1349. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1350. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1351. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1352. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1353. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1354. 6ac.874: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll: Owner is administrators group.
  1355. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003fc pwszName=\Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1356. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1357. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1358. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3EF3BDC1E84DFA17EA056313214EE88EC3E66F79
  1359. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ws2_32.dll'
  1360. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1361. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1362. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1363. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
  1364. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll) WinVerifyTrust
  1365. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1366. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1367. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1368. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1369. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  1370. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1371. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1372. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1373. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  1374. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1375. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1376. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1377. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1378. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  1379. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  1380. 6ac.874: \Device\HarddiskVolume2\Windows\System32\nsi.dll: Owner is administrators group.
  1381. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000410 pwszName=\Device\HarddiskVolume2\Windows\System32\nsi.dll
  1382. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1383. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1384. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AFD8538945F2D05BC1AF949B9B19B7D2D9FBBF8
  1385. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\nsi.dll'
  1386. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1387. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll) WinVerifyTrust
  1388. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1389. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1390. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1391. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1392. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1393. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1394. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1395. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feee060000 LB 0x00519000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1396. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1397. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1398. 6ac.874: supR3HardenedDllNotificationCallback: load 0000000066d50000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1399. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1400. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1401. 6ac.874: supR3HardenedDllNotificationCallback: load 0000000062350000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1402. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1403. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe2f0000 LB 0x0004d000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
  1404. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1405. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefddb0000 LB 0x00008000 C:\Windows\system32\NSI.dll [fFlags=0x0]
  1406. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1407. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1408. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1409. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1410. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1411. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1412. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1413. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1414. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1415. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1416. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1417. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1418. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1419. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1420. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1421. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1422. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1423. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1424. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1425. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1426. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1427. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1428. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1429. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1430. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1431. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1432. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1433. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1434. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1435. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1436. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1437. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1438. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1439. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1440. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1441. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1442. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1443. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1444. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1445. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1446. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1447. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1448. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1449. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1450. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1451. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000874cc0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\GnuWin32\bin;C:\Python27\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\adb;C:\Program Files (x86)\Git\cmd;C:\Program Files (x86)\Git\bin;%USERPROFILE%\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files\Microsoft SQL Server\120\Tools\Binn\;C:\Program Files\Windows Imaging\;C:\Program Files\Common Files\Microsoft Shared\Windows Live [calling]
  1452. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1453. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1454. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1455. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feee060000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1456. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1457. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008d14e0:C:\Windows\system32 [calling]
  1458. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd570000 'C:\Windows\system32\Wintrust.dll'
  1459. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1460. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008d14e0:C:\Windows\system32 [calling]
  1461. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd5b0000 'C:\Windows\system32\crypt32.dll'
  1462. 6ac.874: SUPR3HardenedMain: Load TrustedMain...
  1463. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1464. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1465. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  1466. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1467. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1468. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
  1469. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
  1470. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
  1471. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  1472. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1473. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  1474. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  1475. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  1476. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  1477. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
  1478. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll) WinVerifyTrust
  1479. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1480. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1481. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1482. 6ac.874: \Device\HarddiskVolume2\Windows\System32\winmm.dll: Owner is administrators group.
  1483. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000454 pwszName=\Device\HarddiskVolume2\Windows\System32\winmm.dll
  1484. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1485. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1486. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82E2B2A7826F88BEB98FFF0540C9BDB0A12F001A
  1487. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\winmm.dll'
  1488. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1489. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1490. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1491. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll) WinVerifyTrust
  1492. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1493. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1494. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1495. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1496. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1497. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1498. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1499. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1500. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1501. 6ac.874: \Device\HarddiskVolume2\Windows\System32\shell32.dll: Owner is administrators group.
  1502. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000043c pwszName=\Device\HarddiskVolume2\Windows\System32\shell32.dll
  1503. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1504. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1505. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FCF00DB9BBECF4126AB4076577BBA73C0F94BDF9
  1506. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shell32.dll'
  1507. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1508. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1509. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'shlwapi.dll'.
  1510. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
  1511. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
  1512. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll) WinVerifyTrust
  1513. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1514. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1515. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1516. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1517. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1518. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1519. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1520. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1521. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1522. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1523. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1524. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1525. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1526. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1527. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
  1528. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
  1529. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1530. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1531. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
  1532. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1533. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1534. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1535. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
  1536. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
  1537. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll) WinVerifyTrust
  1538. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1539. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1540. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1541. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1542. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1543. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1544. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1545. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1546. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcr100.dll'.
  1547. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  1548. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1549. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1550. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1551. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1552. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1553. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1554. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1555. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcp100.dll'.
  1556. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcr100.dll'.
  1557. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll) WinVerifyTrust
  1558. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1559. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1560. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1561. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1562. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1563. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1564. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1565. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1566. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1567. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1568. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1569. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll) WinVerifyTrust
  1570. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1571. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1572. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1573. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1574. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1575. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1576. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1577. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1578. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1579. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1580. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1581. 6ac.874: \Device\HarddiskVolume2\Windows\System32\opengl32.dll: Owner is administrators group.
  1582. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000464 pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1583. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1584. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1585. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=608AC397FCC42B9FBAE25CB8C25EAF4C19AA384D
  1586. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
  1587. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1588. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1589. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1590. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1591. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
  1592. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
  1593. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1594. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll) WinVerifyTrust
  1595. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1596. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1597. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1598. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
  1599. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
  1600. 6ac.874: \Device\HarddiskVolume2\Windows\System32\ddraw.dll: Owner is administrators group.
  1601. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000470 pwszName=\Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1602. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1603. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1604. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
  1605. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ddraw.dll'
  1606. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1607. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1608. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1609. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
  1610. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1611. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  1612. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
  1613. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ddraw.dll) WinVerifyTrust
  1614. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1615. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  1616. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  1617. 6ac.874: \Device\HarddiskVolume2\Windows\System32\glu32.dll: Owner is administrators group.
  1618. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000042c pwszName=\Device\HarddiskVolume2\Windows\System32\glu32.dll
  1619. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1620. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1621. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60E45AB914E06A11F44EA76C6EF750AF892F9EA2
  1622. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\glu32.dll'
  1623. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1624. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1625. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1626. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1627. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\glu32.dll) WinVerifyTrust
  1628. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
  1629. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1630. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1631. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1632. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1633. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1634. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1635. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1636. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1637. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1638. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1639. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1640. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1641. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1642. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  1643. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  1644. 6ac.874: \Device\HarddiskVolume2\Windows\System32\mpr.dll: Owner is administrators group.
  1645. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000047c pwszName=\Device\HarddiskVolume2\Windows\System32\mpr.dll
  1646. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1647. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1648. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84FE9BA047B24E7694C9E0C349B48B9FD5F925B
  1649. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\mpr.dll'
  1650. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1651. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mpr.dll) WinVerifyTrust
  1652. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mpr.dll
  1653. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1654. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1655. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1656. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1657. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1658. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1659. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1660. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1661. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1662. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1663. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1664. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1665. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1666. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1667. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1668. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1669. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1670. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1671. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1672. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1673. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1674. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1675. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1676. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1677. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1678. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1679. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1680. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1681. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1682. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1683. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1684. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1685. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1686. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1687. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1688. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1689. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1690. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1691. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1692. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1693. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1694. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1695. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1696. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1697. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  1698. 6ac.874: Error (rc=0):
  1699. 6ac.874: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=16 \Device\HarddiskVolume2\Windows\System32\user32.dll
  1700. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1701. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1702. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1703. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1704. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1705. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  1706. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  1707. 6ac.874: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll: Owner is administrators group.
  1708. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000474 pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  1709. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1710. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1711. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=66EE5BDFFA413AEA9E1FE7838A08646E94136DA5
  1712. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
  1713. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1714. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1715. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
  1716. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1717. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1718. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
  1719. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  1720. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll) WinVerifyTrust
  1721. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  1722. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  1723. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  1724. 6ac.874: \Device\HarddiskVolume2\Windows\System32\winspool.drv: Owner is administrators group.
  1725. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000480 pwszName=\Device\HarddiskVolume2\Windows\System32\winspool.drv
  1726. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1727. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1728. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C89A2ED7B99A056D78CA6BAC9CCAB8B1FF119A14
  1729. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\winspool.drv'
  1730. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1731. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1732. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1733. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1734. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winspool.drv) WinVerifyTrust
  1735. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winspool.drv
  1736. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1737. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1738. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1739. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1740. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1741. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1742. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1743. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1744. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1745. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1746. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1747. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1748. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1749. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1750. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1751. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1752. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1753. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1754. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1755. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1756. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1757. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1758. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1759. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1760. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1761. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1762. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1763. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1764. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1765. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1766. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1767. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1768. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1769. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1770. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1771. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1772. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1773. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1774. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1775. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1776. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1777. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1778. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1779. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1780. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1781. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1782. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1783. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  1784. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  1785. 6ac.874: \Device\HarddiskVolume2\Windows\System32\comctl32.dll: Owner is administrators group.
  1786. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000490 pwszName=\Device\HarddiskVolume2\Windows\System32\comctl32.dll
  1787. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1788. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1789. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4D3B2DA266DE92D9E1311E30C810160CDC5BD5AA
  1790. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
  1791. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1792. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  1793. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1794. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1795. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll) WinVerifyTrust
  1796. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
  1797. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1798. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1799. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1800. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1801. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1802. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1803. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1804. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1805. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1806. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1807. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1808. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1809. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1810. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1811. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1812. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1813. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  1814. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  1815. 6ac.874: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll: Owner is administrators group.
  1816. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000049c pwszName=\Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  1817. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1818. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1819. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B79EE7B5AD74EF51A849809202E043183A2C727E
  1820. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
  1821. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1822. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1823. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1824. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1825. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll) WinVerifyTrust
  1826. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  1827. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1828. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1829. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1830. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1831. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1832. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
  1833. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
  1834. 6ac.874: \Device\HarddiskVolume2\Windows\System32\dciman32.dll: Owner is administrators group.
  1835. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004a0 pwszName=\Device\HarddiskVolume2\Windows\System32\dciman32.dll
  1836. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  1837. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  1838. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3FEC714D729F7CAEB9B7A25E2012B6A6E9007F5
  1839. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dciman32.dll'
  1840. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1841. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1842. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  1843. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1844. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dciman32.dll) WinVerifyTrust
  1845. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  1846. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1847. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1848. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1849. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1850. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1851. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1852. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1853. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1854. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1855. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1856. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1857. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1858. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1859. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1860. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1861. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1862. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1863. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1864. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1865. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1866. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1867. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1868. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1869. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1870. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1871. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1872. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feed780000 LB 0x008de000 C:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  1873. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1874. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1875. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feef080000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [fFlags=0x0]
  1876. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1877. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  1878. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fef28a0000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [fFlags=0x0]
  1879. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  1880. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1881. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feeed80000 LB 0x000f1000 C:\Windows\system32\DDRAW.dll [fFlags=0x0]
  1882. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1883. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  1884. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefb480000 LB 0x00008000 C:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
  1885. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  1886. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdfd0000 LB 0x001d7000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
  1887. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1888. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd490000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  1889. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1890. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdac0000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  1891. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1892. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefdba0000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  1893. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1894. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefd790000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  1895. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
  1896. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  1897. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefb640000 LB 0x00018000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
  1898. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  1899. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1900. 6ac.874: supR3HardenedDllNotificationCallback: load 0000000061df0000 LB 0x00553000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  1901. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1902. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe860000 LB 0x00d88000 C:\Windows\system32\SHELL32.dll [fFlags=0x0]
  1903. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1904. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  1905. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fef9ce0000 LB 0x00018000 C:\Windows\system32\MPR.dll [fFlags=0x0]
  1906. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  1907. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1908. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feed1d0000 LB 0x005a1000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  1909. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1910. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1911. 6ac.874: supR3HardenedDllNotificationCallback: load 00000000618a0000 LB 0x0054f000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  1912. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1913. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1914. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feef590000 LB 0x00051000 C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll [fFlags=0x0]
  1915. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1916. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  1917. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefa3f0000 LB 0x00071000 C:\Windows\system32\WINSPOOL.DRV [fFlags=0x0]
  1918. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  1919. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefe5b0000 LB 0x00097000 C:\Windows\system32\COMDLG32.dll [fFlags=0x0]
  1920. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  1921. 6ac.874: \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll: Owner is administrators group.
  1922. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  1923. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1924. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1925. 6ac.874: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll)
  1926. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll
  1927. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefa4d0000 LB 0x000a0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32.dll [fFlags=0x0]
  1928. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll [avoiding WinVerifyTrust]
  1929. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1930. 6ac.874: supR3HardenedDllNotificationCallback: load 00000000729f0000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  1931. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1932. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1933. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefa910000 LB 0x0003b000 C:\Windows\system32\WINMM.dll [fFlags=0x0]
  1934. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1935. 6ac.874: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll'.
  1936. 6ac.874: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll' [rescheduled]
  1937. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  1938. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1939. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1940. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1941. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1942. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1943. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1944. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f1a50:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1945. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefda90000 'C:\Windows\system32\imm32.dll'
  1946. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe400000 'C:\Windows\system32\ADVAPI32.DLL'
  1947. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1948. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptbase.dll (Input=cryptbase.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  1949. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd310000 'C:\Windows\system32\cryptbase.dll'
  1950. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feed780000 'C:\Program Files\Oracle\VirtualBox\VirtualBox.dll'
  1951. 6ac.874: SUPR3HardenedMain: Calling TrustedMain (000007feed7815f0)...
  1952. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1953. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1954. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdba0000 'C:\Windows\system32\ole32.dll'
  1955. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe400000 'C:\Windows\system32\ADVAPI32.dll'
  1956. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1957. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1958. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe860000 'C:\Windows\system32\shell32.dll'
  1959. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1960. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'imm32.dll'.
  1961. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'winmm.dll'.
  1962. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
  1963. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1964. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1965. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
  1966. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1967. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  1968. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  1969. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  1970. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  1971. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  1972. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1973. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1974. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1975. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1976. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1977. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1978. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1979. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1980. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1981. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1982. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1983. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1984. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1985. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1986. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1987. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1988. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1989. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1990. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1991. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1992. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1993. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1994. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1995. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1996. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1997. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  1998. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1999. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2000. 6ac.874: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2001. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2002. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2003. 6ac.874: supR3HardenedDllNotificationCallback: load 000007feeec50000 LB 0x00127000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  2004. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2005. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feeec50000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  2006. 6ac.874: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll: Owner is administrators group.
  2007. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000538 pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2008. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008b5c10
  2009. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008b5c10
  2010. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=936D45CC7026757A151F62882B557DD75D5FCB21
  2011. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
  2012. 6ac.874: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2013. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2014. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2015. 6ac.874: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  2016. 6ac.874: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll) WinVerifyTrust
  2017. 6ac.874: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2018. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2019. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2020. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2021. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2022. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2023. 6ac.874: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2024. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000941a60:C:\Windows\system32;C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2025. 6ac.874: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2026. 6ac.874: supR3HardenedDllNotificationCallback: load 000007fefba10000 LB 0x00056000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
  2027. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2028. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefba10000 'C:\Windows\system32\uxtheme.dll'
  2029. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2030. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000941a60:C:\Windows\system32;C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2031. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefba10000 'C:\Windows\system32\uxtheme.dll'
  2032. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2033. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000009419b0:C:\Windows\system32;C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2034. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefba10000 'C:\Windows\system32\uxtheme.dll'
  2035. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2036. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000009419b0:C:\Windows\system32;C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2037. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefba10000 'C:\Windows\system32\uxtheme.dll'
  2038. 6ac.874: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2039. 6ac.874: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000008f19c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  2040. 6ac.874: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd310000 'C:\Windows\system32\CRYPTBASE.dll'
  2041. bd0.4bc: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 983 ms, the end);
  2042. f84.131c: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1330 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!