API tools faq
paste
Advertisement
Guest User

VBoxStartup.log

a guest
Nov 10th, 2014
544
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 316.86 KB | None | 0 0
raw download clone embed print report
  1. 172c.23cc: Log file opened: 4.3.18r96516 g_hStartupLog=00000000000000ac g_uNtVerCombined=0x611db110
  2. 172c.23cc: \SystemRoot\System32\ntdll.dll:
  3. 172c.23cc: CreationTime: 2014-01-28T09:07:34.178841200Z
  4. 172c.23cc: LastWriteTime: 2013-08-29T02:16:35.515578900Z
  5. 172c.23cc: ChangeTime: 2014-01-29T10:27:11.233869200Z
  6. 172c.23cc: FileAttributes: 0x20
  7. 172c.23cc: Size: 0x1a6dc0
  8. 172c.23cc: NT Headers: 0xe0
  9. 172c.23cc: Timestamp: 0x521eaf24
  10. 172c.23cc: Machine: 0x8664 - amd64
  11. 172c.23cc: Timestamp: 0x521eaf24
  12. 172c.23cc: Image Version: 6.1
  13. 172c.23cc: SizeOfImage: 0x1a9000 (1740800)
  14. 172c.23cc: Resource Dir: 0x151000 LB 0x560d8
  15. 172c.23cc: ProductName: Microsoft® Windows® Operating System
  16. 172c.23cc: ProductVersion: 6.1.7601.18247
  17. 172c.23cc: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  18. 172c.23cc: FileDescription: NT Layer DLL
  19. 172c.23cc: \SystemRoot\System32\kernel32.dll:
  20. 172c.23cc: CreationTime: 2014-04-08T21:52:30.104216500Z
  21. 172c.23cc: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  22. 172c.23cc: ChangeTime: 2014-04-09T12:16:53.175438800Z
  23. 172c.23cc: FileAttributes: 0x20
  24. 172c.23cc: Size: 0x11c000
  25. 172c.23cc: NT Headers: 0xe8
  26. 172c.23cc: Timestamp: 0x5315a059
  27. 172c.23cc: Machine: 0x8664 - amd64
  28. 172c.23cc: Timestamp: 0x5315a059
  29. 172c.23cc: Image Version: 6.1
  30. 172c.23cc: SizeOfImage: 0x11f000 (1175552)
  31. 172c.23cc: Resource Dir: 0x116000 LB 0x528
  32. 172c.23cc: ProductName: Microsoft® Windows® Operating System
  33. 172c.23cc: ProductVersion: 6.1.7601.18409
  34. 172c.23cc: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  35. 172c.23cc: FileDescription: Windows NT BASE API Client DLL
  36. 172c.23cc: \SystemRoot\System32\KernelBase.dll:
  37. 172c.23cc: CreationTime: 2014-05-14T09:33:25.738973800Z
  38. 172c.23cc: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  39. 172c.23cc: ChangeTime: 2014-05-15T03:47:18.721360200Z
  40. 172c.23cc: FileAttributes: 0x20
  41. 172c.23cc: Size: 0x67c00
  42. 172c.23cc: NT Headers: 0xe8
  43. 172c.23cc: Timestamp: 0x5315a05a
  44. 172c.23cc: Machine: 0x8664 - amd64
  45. 172c.23cc: Timestamp: 0x5315a05a
  46. 172c.23cc: Image Version: 6.1
  47. 172c.23cc: SizeOfImage: 0x6c000 (442368)
  48. 172c.23cc: Resource Dir: 0x6a000 LB 0x530
  49. 172c.23cc: ProductName: Microsoft® Windows® Operating System
  50. 172c.23cc: ProductVersion: 6.1.7601.18409
  51. 172c.23cc: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  52. 172c.23cc: FileDescription: Windows NT BASE API Client DLL
  53. 172c.23cc: \SystemRoot\System32\apisetschema.dll:
  54. 172c.23cc: CreationTime: 2014-01-28T09:08:32.878922200Z
  55. 172c.23cc: LastWriteTime: 2013-08-02T02:12:20.275000000Z
  56. 172c.23cc: ChangeTime: 2014-01-29T10:27:13.152672600Z
  57. 172c.23cc: FileAttributes: 0x20
  58. 172c.23cc: Size: 0x1a00
  59. 172c.23cc: NT Headers: 0xc0
  60. 172c.23cc: Timestamp: 0x51fb15ca
  61. 172c.23cc: Machine: 0x8664 - amd64
  62. 172c.23cc: Timestamp: 0x51fb15ca
  63. 172c.23cc: Image Version: 6.1
  64. 172c.23cc: SizeOfImage: 0x50000 (327680)
  65. 172c.23cc: Resource Dir: 0x30000 LB 0x3f8
  66. 172c.23cc: ProductName: Microsoft® Windows® Operating System
  67. 172c.23cc: ProductVersion: 6.1.7601.18229
  68. 172c.23cc: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
  69. 172c.23cc: FileDescription: ApiSet Schema DLL
  70. 172c.23cc: Found driver klkbdflt (0x40)
  71. 172c.23cc: Found driver KLIM6 (0x40)
  72. 172c.23cc: Found driver klmouflt (0x40)
  73. 172c.23cc: Found driver kl1 (0x40)
  74. 172c.23cc: Found driver klflt (0x40)
  75. 172c.23cc: Found driver kneps (0x40)
  76. 172c.23cc: Found driver kltdi (0x40)
  77. 172c.23cc: supR3HardenedWinFindAdversaries: 0x40
  78. 172c.23cc: \SystemRoot\System32\drivers\kl1.sys:
  79. 172c.23cc: CreationTime: 2014-02-20T16:59:04.000000000Z
  80. 172c.23cc: LastWriteTime: 2014-02-20T16:59:04.000000000Z
  81. 172c.23cc: ChangeTime: 2014-09-04T14:40:22.795097400Z
  82. 172c.23cc: FileAttributes: 0x20
  83. 172c.23cc: Size: 0x6fc60
  84. 172c.23cc: NT Headers: 0xe0
  85. 172c.23cc: Timestamp: 0x5305c3be
  86. 172c.23cc: Machine: 0x8664 - amd64
  87. 172c.23cc: Timestamp: 0x5305c3be
  88. 172c.23cc: Image Version: 0.0
  89. 172c.23cc: SizeOfImage: 0x75f000 (7729152)
  90. 172c.23cc: Resource Dir: 0x75d000 LB 0x448
  91. 172c.23cc: ProductName: Kaspersky Anti-Virus
  92. 172c.23cc: ProductVersion: 6.0.1.990
  93. 172c.23cc: FileVersion: 6.8.0.38
  94. 172c.23cc: FileDescription: Kaspersky Unified Driver
  95. 172c.23cc: \SystemRoot\System32\drivers\klflt.sys:
  96. 172c.23cc: CreationTime: 2014-09-04T14:40:11.094178200Z
  97. 172c.23cc: LastWriteTime: 2014-10-09T03:08:42.354945300Z
  98. 172c.23cc: ChangeTime: 2014-10-09T03:08:47.605245600Z
  99. 172c.23cc: FileAttributes: 0x20
  100. 172c.23cc: Size: 0x22808
  101. 172c.23cc: NT Headers: 0xf8
  102. 172c.23cc: Timestamp: 0x540718a7
  103. 172c.23cc: Machine: 0x8664 - amd64
  104. 172c.23cc: Timestamp: 0x540718a7
  105. 172c.23cc: Image Version: 6.0
  106. 172c.23cc: SizeOfImage: 0x33000 (208896)
  107. 172c.23cc: Resource Dir: 0x31000 LB 0x370
  108. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  109. 172c.23cc: ProductVersion: 1.5.0.27
  110. 172c.23cc: FileVersion: 1.5.0.27
  111. 172c.23cc: FileDescription: Filter Core [fre_wlh_x64]
  112. 172c.23cc: \SystemRoot\System32\drivers\klif.sys:
  113. 172c.23cc: CreationTime: 2014-09-04T14:40:11.078177300Z
  114. 172c.23cc: LastWriteTime: 2014-10-09T03:08:42.468951800Z
  115. 172c.23cc: ChangeTime: 2014-10-09T03:08:47.619246400Z
  116. 172c.23cc: FileAttributes: 0x20
  117. 172c.23cc: Size: 0xc1cc8
  118. 172c.23cc: NT Headers: 0x108
  119. 172c.23cc: Timestamp: 0x542567a1
  120. 172c.23cc: Machine: 0x8664 - amd64
  121. 172c.23cc: Timestamp: 0x542567a1
  122. 172c.23cc: Image Version: 6.0
  123. 172c.23cc: SizeOfImage: 0xca000 (827392)
  124. 172c.23cc: Resource Dir: 0xc7000 LB 0x1240
  125. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  126. 172c.23cc: ProductVersion: 8.15.0.241
  127. 172c.23cc: FileVersion: 8.15.0.241
  128. 172c.23cc: FileDescription: Klif Mini-Filter [fre_wlh_x64]
  129. 172c.23cc: \SystemRoot\System32\drivers\klim6.sys:
  130. 172c.23cc: CreationTime: 2014-02-25T17:09:02.000000000Z
  131. 172c.23cc: LastWriteTime: 2014-02-25T17:09:02.000000000Z
  132. 172c.23cc: ChangeTime: 2014-09-04T14:40:22.567084400Z
  133. 172c.23cc: FileAttributes: 0x20
  134. 172c.23cc: Size: 0x7660
  135. 172c.23cc: NT Headers: 0x100
  136. 172c.23cc: Timestamp: 0x530c5da9
  137. 172c.23cc: Machine: 0x8664 - amd64
  138. 172c.23cc: Timestamp: 0x530c5da9
  139. 172c.23cc: Image Version: 6.0
  140. 172c.23cc: SizeOfImage: 0xa000 (40960)
  141. 172c.23cc: Resource Dir: 0x8000 LB 0x470
  142. 172c.23cc: ProductName: Kaspersky Anti-Virus
  143. 172c.23cc: ProductVersion: 6.0.1.990
  144. 172c.23cc: FileVersion: 8.0.0.83
  145. 172c.23cc: FileDescription: Kaspersky Lab Intermediate Network Driver
  146. 172c.23cc: \SystemRoot\System32\drivers\klkbdflt.sys:
  147. 172c.23cc: CreationTime: 2014-03-28T21:51:04.000000000Z
  148. 172c.23cc: LastWriteTime: 2014-03-28T21:51:04.000000000Z
  149. 172c.23cc: ChangeTime: 2014-09-04T14:40:23.463135700Z
  150. 172c.23cc: FileAttributes: 0x20
  151. 172c.23cc: Size: 0x7060
  152. 172c.23cc: NT Headers: 0xf8
  153. 172c.23cc: Timestamp: 0x53357e3c
  154. 172c.23cc: Machine: 0x8664 - amd64
  155. 172c.23cc: Timestamp: 0x53357e3c
  156. 172c.23cc: Image Version: 6.0
  157. 172c.23cc: SizeOfImage: 0xc000 (49152)
  158. 172c.23cc: Resource Dir: 0xa000 LB 0x3a8
  159. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  160. 172c.23cc: ProductVersion: 8.14.0.13
  161. 172c.23cc: FileVersion: 8.14.0.13
  162. 172c.23cc: FileDescription: KLKBDFLT Keyboard Device Filter [fre_wlh_x64]
  163. 172c.23cc: \SystemRoot\System32\drivers\klmouflt.sys:
  164. 172c.23cc: CreationTime: 2013-08-08T21:11:00.000000000Z
  165. 172c.23cc: LastWriteTime: 2013-08-08T21:11:00.000000000Z
  166. 172c.23cc: ChangeTime: 2014-09-04T14:40:23.365130100Z
  167. 172c.23cc: FileAttributes: 0x20
  168. 172c.23cc: Size: 0x7260
  169. 172c.23cc: NT Headers: 0xe8
  170. 172c.23cc: Timestamp: 0x520398aa
  171. 172c.23cc: Machine: 0x8664 - amd64
  172. 172c.23cc: Timestamp: 0x520398aa
  173. 172c.23cc: Image Version: 6.0
  174. 172c.23cc: SizeOfImage: 0xc000 (49152)
  175. 172c.23cc: Resource Dir: 0xa000 LB 0x3a8
  176. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  177. 172c.23cc: ProductVersion: 8.10.0.41
  178. 172c.23cc: FileVersion: 8.10.0.41
  179. 172c.23cc: FileDescription: KLMOUFLT Mouse Device Filter [fre_wlh_x64]
  180. 172c.23cc: \SystemRoot\System32\drivers\kltdi.sys:
  181. 172c.23cc: CreationTime: 2014-03-25T20:26:04.000000000Z
  182. 172c.23cc: LastWriteTime: 2014-03-25T20:26:04.000000000Z
  183. 172c.23cc: ChangeTime: 2014-09-04T14:40:23.685148400Z
  184. 172c.23cc: FileAttributes: 0x20
  185. 172c.23cc: Size: 0xda60
  186. 172c.23cc: NT Headers: 0x100
  187. 172c.23cc: Timestamp: 0x533175d2
  188. 172c.23cc: Machine: 0x8664 - amd64
  189. 172c.23cc: Timestamp: 0x533175d2
  190. 172c.23cc: Image Version: 6.1
  191. 172c.23cc: SizeOfImage: 0x10000 (65536)
  192. 172c.23cc: Resource Dir: 0xe000 LB 0x3b8
  193. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  194. 172c.23cc: ProductVersion: 1.7.0.5
  195. 172c.23cc: FileVersion: 1.7.0.5 built by: WinDDK
  196. 172c.23cc: FileDescription: Network filtering component [fre_wnet_amd64]
  197. 172c.23cc: \SystemRoot\System32\drivers\kneps.sys:
  198. 172c.23cc: CreationTime: 2014-03-26T21:05:28.000000000Z
  199. 172c.23cc: LastWriteTime: 2014-03-26T21:05:28.000000000Z
  200. 172c.23cc: ChangeTime: 2014-09-04T14:40:23.793154500Z
  201. 172c.23cc: FileAttributes: 0x20
  202. 172c.23cc: Size: 0x2bc60
  203. 172c.23cc: NT Headers: 0x118
  204. 172c.23cc: Timestamp: 0x5332d05f
  205. 172c.23cc: Machine: 0x8664 - amd64
  206. 172c.23cc: Timestamp: 0x5332d05f
  207. 172c.23cc: Image Version: 6.1
  208. 172c.23cc: SizeOfImage: 0x2d000 (184320)
  209. 172c.23cc: Resource Dir: 0x2b000 LB 0x398
  210. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  211. 172c.23cc: ProductVersion: 5.7.0.7
  212. 172c.23cc: FileVersion: 5.7.0.7 built by: WinDDK
  213. 172c.23cc: FileDescription: KNEPS Power [fre_wnet_amd64]
  214. 172c.23cc: \SystemRoot\System32\klfphc.dll:
  215. 172c.23cc: CreationTime: 2014-09-04T14:40:23.778153700Z
  216. 172c.23cc: LastWriteTime: 2013-05-06T13:13:26.000000000Z
  217. 172c.23cc: ChangeTime: 2014-09-04T14:40:17.489544000Z
  218. 172c.23cc: FileAttributes: 0x20
  219. 172c.23cc: Size: 0x1ae60
  220. 172c.23cc: NT Headers: 0xe8
  221. 172c.23cc: Timestamp: 0x51873bf2
  222. 172c.23cc: Machine: 0x8664 - amd64
  223. 172c.23cc: Timestamp: 0x51873bf2
  224. 172c.23cc: Image Version: 0.0
  225. 172c.23cc: SizeOfImage: 0x1d000 (118784)
  226. 172c.23cc: Resource Dir: 0x18000 LB 0x3c80
  227. 172c.23cc: ProductName: Kaspersky™ Anti-Virus ®
  228. 172c.23cc: ProductVersion: 1.0.0.12
  229. 172c.23cc: FileVersion: 1.0.0.12
  230. 172c.23cc: FileDescription: Filtering Platform Helper Class
  231. 172c.23cc: Calling main()
  232. 172c.23cc: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  233. 172c.23cc: SUPR3HardenedMain: Respawn #1
  234. 172c.23cc: System32: \Device\HarddiskVolume2\Windows\System32
  235. 172c.23cc: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  236. 172c.23cc: KnownDllPath: A:\Windows\system32
  237. 172c.23cc: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  238. 172c.23cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  239. 172c.23cc: supR3HardNtEnableThreadCreation:
  240. 172c.23cc: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000077aac340 pvNtTerminateThread=0000000077ad17e0
  241. 172c.23cc: supR3HardenedWinDoReSpawn(1): New child 1a10.2cc0 [kernel32].
  242. 172c.23cc: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd3000 cbPeb=0x380
  243. 172c.23cc: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077a80000 uNtDllChildAddr=0000000077a80000
  244. 172c.23cc: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000077aac340
  245. 172c.23cc: supR3HardenedWinSetupChildInit: Start child.
  246. 172c.23cc: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  247. 172c.23cc: supR3HardNtChildPurify: Startup delay kludge #1/0: 513 ms, 64 sleeps
  248. 172c.23cc: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  249. 172c.23cc: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
  250. 172c.23cc: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
  251. 172c.23cc: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
  252. 172c.23cc: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
  253. 172c.23cc: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
  254. 172c.23cc: 0000000000041000-0000000000031fff 0x0001/0x0000 0x0000000
  255. 172c.23cc: *0000000000050000-000000000004efff 0x0004/0x0004 0x0020000
  256. 172c.23cc: 0000000000051000-ffffffffffe91fff 0x0001/0x0000 0x0000000
  257. 172c.23cc: *0000000000210000-0000000000113fff 0x0000/0x0004 0x0020000
  258. 172c.23cc: 000000000030c000-0000000000308fff 0x0104/0x0004 0x0020000
  259. 172c.23cc: 000000000030f000-000000000030dfff 0x0004/0x0004 0x0020000
  260. 172c.23cc: 0000000000310000-ffffffff88b9ffff 0x0001/0x0000 0x0000000
  261. 172c.23cc: *0000000077a80000-0000000077a7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  262. 172c.23cc: 0000000077a81000-000000007797efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  263. 172c.23cc: 0000000077b83000-0000000077b53fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  264. 172c.23cc: 0000000077bb2000-0000000077ba9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  265. 172c.23cc: 0000000077bba000-0000000077bb8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  266. 172c.23cc: 0000000077bbb000-0000000077bb7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  267. 172c.23cc: 0000000077bbe000-0000000077b52fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  268. 172c.23cc: 0000000077c29000-0000000070871fff 0x0001/0x0000 0x0000000
  269. 172c.23cc: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
  270. 172c.23cc: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
  271. 172c.23cc: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
  272. 172c.23cc: 000000007fff0000-ffffffffc0c3ffff 0x0001/0x0000 0x0000000
  273. 172c.23cc: *000000013f3a0000-000000013f39efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  274. 172c.23cc: 000000013f3a1000-000000013f31cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  275. 172c.23cc: 000000013f425000-000000013f423fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  276. 172c.23cc: 000000013f426000-000000013f3e8fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  277. 172c.23cc: 000000013f463000-000000013f461fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  278. 172c.23cc: 000000013f464000-000000013f462fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  279. 172c.23cc: 000000013f465000-000000013f462fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  280. 172c.23cc: 000000013f467000-000000013f465fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  281. 172c.23cc: 000000013f468000-000000013f466fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  282. 172c.23cc: 000000013f469000-000000013f464fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  283. 172c.23cc: 000000013f46d000-000000013f433fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  284. 172c.23cc: 000000013f4a6000-fffff8037ebabfff 0x0001/0x0000 0x0000000
  285. 172c.23cc: *000007feffda0000-000007feffd9efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  286. 172c.23cc: 000007feffda1000-000007fdffb91fff 0x0001/0x0000 0x0000000
  287. 172c.23cc: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
  288. 172c.23cc: *000007fffffd3000-000007fffffd1fff 0x0004/0x0004 0x0020000
  289. 172c.23cc: 000007fffffd4000-000007fffffc9fff 0x0001/0x0000 0x0000000
  290. 172c.23cc: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
  291. 172c.23cc: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
  292. 172c.23cc: apisetschema.dll: timestamp 0x51fb15ca (rc=VINF_SUCCESS)
  293. 172c.23cc: VirtualBox.exe: timestamp 0x5439147c (rc=VINF_SUCCESS)
  294. 172c.23cc: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  295. 172c.23cc: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  296. 172c.23cc: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  297. 172c.23cc: supR3HardNtChildPurify: Done after 551 ms and 0 fixes (loop #0).
  298. 1a10.2cc0: Log file opened: 4.3.18r96516 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110
  299. 1a10.2cc0: supR3HardenedVmProcessInit: uNtDllAddr=0000000077a80000
  300. 1a10.2cc0: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
  301. 1a10.2cc0: New simple heap: #1 0000000000310000 LB 0x400000 (for 1740800 allocation)
  302. 172c.23cc: supR3HardNtEnableThreadCreation:
  303. 1a10.2cc0: System32: \Device\HarddiskVolume2\Windows\System32
  304. 1a10.2cc0: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  305. 1a10.2cc0: KnownDllPath: A:\Windows\system32
  306. 1a10.2cc0: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  307. 1a10.2cc0: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  308. 1a10.2cc0: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  309. 1a10.2cc0: Registered Dll notification callback with NTDLL.
  310. 1a10.2cc0: supR3HardenedMonitor_LdrLoadDll: 'kernel32.dll' -> 'A:\Windows\system32\kernel32.dll' [rcNt=0xc0150008]
  311. 1a10.2cc0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  312. 1a10.2cc0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  313. 1a10.2cc0: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\kernel32.dll *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  314. 1a10.2cc0: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  315. 1a10.2cc0: supR3HardenedDllNotificationCallback: load 0000000077960000 LB 0x0011f000 A:\Windows\system32\kernel32.dll [fFlags=0x0]
  316. 1a10.2cc0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  317. 1a10.2cc0: supR3HardenedDllNotificationCallback: load 000007fefd900000 LB 0x0006c000 A:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  318. 1a10.2cc0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  319. 1a10.2cc0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  320. 1a10.2cc0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077960000 'A:\Windows\system32\kernel32.dll'
  321. 1a10.2cc0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000077aac340 pvNtTerminateThread=0000000077ad17e0
  322. 172c.23cc: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 41 ms.
  323. 1a10.2cc0: \SystemRoot\System32\ntdll.dll:
  324. 1a10.2cc0: CreationTime: 2014-01-28T09:07:34.178841200Z
  325. 1a10.2cc0: LastWriteTime: 2013-08-29T02:16:35.515578900Z
  326. 1a10.2cc0: ChangeTime: 2014-01-29T10:27:11.233869200Z
  327. 1a10.2cc0: FileAttributes: 0x20
  328. 1a10.2cc0: Size: 0x1a6dc0
  329. 1a10.2cc0: NT Headers: 0xe0
  330. 1a10.2cc0: Timestamp: 0x521eaf24
  331. 1a10.2cc0: Machine: 0x8664 - amd64
  332. 1a10.2cc0: Timestamp: 0x521eaf24
  333. 1a10.2cc0: Image Version: 6.1
  334. 1a10.2cc0: SizeOfImage: 0x1a9000 (1740800)
  335. 1a10.2cc0: Resource Dir: 0x151000 LB 0x560d8
  336. 1a10.2cc0: ProductName: Microsoft® Windows® Operating System
  337. 1a10.2cc0: ProductVersion: 6.1.7601.18247
  338. 1a10.2cc0: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  339. 1a10.2cc0: FileDescription: NT Layer DLL
  340. 1a10.2cc0: \SystemRoot\System32\kernel32.dll:
  341. 1a10.2cc0: CreationTime: 2014-04-08T21:52:30.104216500Z
  342. 1a10.2cc0: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  343. 1a10.2cc0: ChangeTime: 2014-04-09T12:16:53.175438800Z
  344. 1a10.2cc0: FileAttributes: 0x20
  345. 1a10.2cc0: Size: 0x11c000
  346. 1a10.2cc0: NT Headers: 0xe8
  347. 1a10.2cc0: Timestamp: 0x5315a059
  348. 1a10.2cc0: Machine: 0x8664 - amd64
  349. 1a10.2cc0: Timestamp: 0x5315a059
  350. 1a10.2cc0: Image Version: 6.1
  351. 1a10.2cc0: SizeOfImage: 0x11f000 (1175552)
  352. 1a10.2cc0: Resource Dir: 0x116000 LB 0x528
  353. 1a10.2cc0: ProductName: Microsoft® Windows® Operating System
  354. 1a10.2cc0: ProductVersion: 6.1.7601.18409
  355. 1a10.2cc0: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  356. 1a10.2cc0: FileDescription: Windows NT BASE API Client DLL
  357. 1a10.2cc0: \SystemRoot\System32\KernelBase.dll:
  358. 1a10.2cc0: CreationTime: 2014-05-14T09:33:25.738973800Z
  359. 1a10.2cc0: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  360. 1a10.2cc0: ChangeTime: 2014-05-15T03:47:18.721360200Z
  361. 1a10.2cc0: FileAttributes: 0x20
  362. 1a10.2cc0: Size: 0x67c00
  363. 1a10.2cc0: NT Headers: 0xe8
  364. 1a10.2cc0: Timestamp: 0x5315a05a
  365. 1a10.2cc0: Machine: 0x8664 - amd64
  366. 1a10.2cc0: Timestamp: 0x5315a05a
  367. 1a10.2cc0: Image Version: 6.1
  368. 1a10.2cc0: SizeOfImage: 0x6c000 (442368)
  369. 1a10.2cc0: Resource Dir: 0x6a000 LB 0x530
  370. 1a10.2cc0: ProductName: Microsoft® Windows® Operating System
  371. 1a10.2cc0: ProductVersion: 6.1.7601.18409
  372. 1a10.2cc0: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  373. 1a10.2cc0: FileDescription: Windows NT BASE API Client DLL
  374. 1a10.2cc0: \SystemRoot\System32\apisetschema.dll:
  375. 1a10.2cc0: CreationTime: 2014-01-28T09:08:32.878922200Z
  376. 1a10.2cc0: LastWriteTime: 2013-08-02T02:12:20.275000000Z
  377. 1a10.2cc0: ChangeTime: 2014-01-29T10:27:13.152672600Z
  378. 1a10.2cc0: FileAttributes: 0x20
  379. 1a10.2cc0: Size: 0x1a00
  380. 1a10.2cc0: NT Headers: 0xc0
  381. 1a10.2cc0: Timestamp: 0x51fb15ca
  382. 1a10.2cc0: Machine: 0x8664 - amd64
  383. 1a10.2cc0: Timestamp: 0x51fb15ca
  384. 1a10.2cc0: Image Version: 6.1
  385. 1a10.2cc0: SizeOfImage: 0x50000 (327680)
  386. 1a10.2cc0: Resource Dir: 0x30000 LB 0x3f8
  387. 1a10.2cc0: ProductName: Microsoft® Windows® Operating System
  388. 1a10.2cc0: ProductVersion: 6.1.7601.18229
  389. 1a10.2cc0: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
  390. 1a10.2cc0: FileDescription: ApiSet Schema DLL
  391. 1a10.2cc0: Found driver klkbdflt (0x40)
  392. 1a10.2cc0: Found driver KLIM6 (0x40)
  393. 1a10.2cc0: Found driver klmouflt (0x40)
  394. 1a10.2cc0: Found driver kl1 (0x40)
  395. 1a10.2cc0: Found driver klflt (0x40)
  396. 1a10.2cc0: Found driver kneps (0x40)
  397. 1a10.2cc0: Found driver kltdi (0x40)
  398. 1a10.2cc0: supR3HardenedWinFindAdversaries: 0x40
  399. 1a10.2cc0: \SystemRoot\System32\drivers\kl1.sys:
  400. 1a10.2cc0: CreationTime: 2014-02-20T16:59:04.000000000Z
  401. 1a10.2cc0: LastWriteTime: 2014-02-20T16:59:04.000000000Z
  402. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:22.795097400Z
  403. 1a10.2cc0: FileAttributes: 0x20
  404. 1a10.2cc0: Size: 0x6fc60
  405. 1a10.2cc0: NT Headers: 0xe0
  406. 1a10.2cc0: Timestamp: 0x5305c3be
  407. 1a10.2cc0: Machine: 0x8664 - amd64
  408. 1a10.2cc0: Timestamp: 0x5305c3be
  409. 1a10.2cc0: Image Version: 0.0
  410. 1a10.2cc0: SizeOfImage: 0x75f000 (7729152)
  411. 1a10.2cc0: Resource Dir: 0x75d000 LB 0x448
  412. 1a10.2cc0: ProductName: Kaspersky Anti-Virus
  413. 1a10.2cc0: ProductVersion: 6.0.1.990
  414. 1a10.2cc0: FileVersion: 6.8.0.38
  415. 1a10.2cc0: FileDescription: Kaspersky Unified Driver
  416. 1a10.2cc0: \SystemRoot\System32\drivers\klflt.sys:
  417. 1a10.2cc0: CreationTime: 2014-09-04T14:40:11.094178200Z
  418. 1a10.2cc0: LastWriteTime: 2014-10-09T03:08:42.354945300Z
  419. 1a10.2cc0: ChangeTime: 2014-10-09T03:08:47.605245600Z
  420. 1a10.2cc0: FileAttributes: 0x20
  421. 1a10.2cc0: Size: 0x22808
  422. 1a10.2cc0: NT Headers: 0xf8
  423. 1a10.2cc0: Timestamp: 0x540718a7
  424. 1a10.2cc0: Machine: 0x8664 - amd64
  425. 1a10.2cc0: Timestamp: 0x540718a7
  426. 1a10.2cc0: Image Version: 6.0
  427. 1a10.2cc0: SizeOfImage: 0x33000 (208896)
  428. 1a10.2cc0: Resource Dir: 0x31000 LB 0x370
  429. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  430. 1a10.2cc0: ProductVersion: 1.5.0.27
  431. 1a10.2cc0: FileVersion: 1.5.0.27
  432. 1a10.2cc0: FileDescription: Filter Core [fre_wlh_x64]
  433. 1a10.2cc0: \SystemRoot\System32\drivers\klif.sys:
  434. 1a10.2cc0: CreationTime: 2014-09-04T14:40:11.078177300Z
  435. 1a10.2cc0: LastWriteTime: 2014-10-09T03:08:42.468951800Z
  436. 1a10.2cc0: ChangeTime: 2014-10-09T03:08:47.619246400Z
  437. 1a10.2cc0: FileAttributes: 0x20
  438. 1a10.2cc0: Size: 0xc1cc8
  439. 1a10.2cc0: NT Headers: 0x108
  440. 1a10.2cc0: Timestamp: 0x542567a1
  441. 1a10.2cc0: Machine: 0x8664 - amd64
  442. 1a10.2cc0: Timestamp: 0x542567a1
  443. 1a10.2cc0: Image Version: 6.0
  444. 1a10.2cc0: SizeOfImage: 0xca000 (827392)
  445. 1a10.2cc0: Resource Dir: 0xc7000 LB 0x1240
  446. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  447. 1a10.2cc0: ProductVersion: 8.15.0.241
  448. 1a10.2cc0: FileVersion: 8.15.0.241
  449. 1a10.2cc0: FileDescription: Klif Mini-Filter [fre_wlh_x64]
  450. 1a10.2cc0: \SystemRoot\System32\drivers\klim6.sys:
  451. 1a10.2cc0: CreationTime: 2014-02-25T17:09:02.000000000Z
  452. 1a10.2cc0: LastWriteTime: 2014-02-25T17:09:02.000000000Z
  453. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:22.567084400Z
  454. 1a10.2cc0: FileAttributes: 0x20
  455. 1a10.2cc0: Size: 0x7660
  456. 1a10.2cc0: NT Headers: 0x100
  457. 1a10.2cc0: Timestamp: 0x530c5da9
  458. 1a10.2cc0: Machine: 0x8664 - amd64
  459. 1a10.2cc0: Timestamp: 0x530c5da9
  460. 1a10.2cc0: Image Version: 6.0
  461. 1a10.2cc0: SizeOfImage: 0xa000 (40960)
  462. 1a10.2cc0: Resource Dir: 0x8000 LB 0x470
  463. 1a10.2cc0: ProductName: Kaspersky Anti-Virus
  464. 1a10.2cc0: ProductVersion: 6.0.1.990
  465. 1a10.2cc0: FileVersion: 8.0.0.83
  466. 1a10.2cc0: FileDescription: Kaspersky Lab Intermediate Network Driver
  467. 1a10.2cc0: \SystemRoot\System32\drivers\klkbdflt.sys:
  468. 1a10.2cc0: CreationTime: 2014-03-28T21:51:04.000000000Z
  469. 1a10.2cc0: LastWriteTime: 2014-03-28T21:51:04.000000000Z
  470. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:23.463135700Z
  471. 1a10.2cc0: FileAttributes: 0x20
  472. 1a10.2cc0: Size: 0x7060
  473. 1a10.2cc0: NT Headers: 0xf8
  474. 1a10.2cc0: Timestamp: 0x53357e3c
  475. 1a10.2cc0: Machine: 0x8664 - amd64
  476. 1a10.2cc0: Timestamp: 0x53357e3c
  477. 1a10.2cc0: Image Version: 6.0
  478. 1a10.2cc0: SizeOfImage: 0xc000 (49152)
  479. 1a10.2cc0: Resource Dir: 0xa000 LB 0x3a8
  480. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  481. 1a10.2cc0: ProductVersion: 8.14.0.13
  482. 1a10.2cc0: FileVersion: 8.14.0.13
  483. 1a10.2cc0: FileDescription: KLKBDFLT Keyboard Device Filter [fre_wlh_x64]
  484. 1a10.2cc0: \SystemRoot\System32\drivers\klmouflt.sys:
  485. 1a10.2cc0: CreationTime: 2013-08-08T21:11:00.000000000Z
  486. 1a10.2cc0: LastWriteTime: 2013-08-08T21:11:00.000000000Z
  487. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:23.365130100Z
  488. 1a10.2cc0: FileAttributes: 0x20
  489. 1a10.2cc0: Size: 0x7260
  490. 1a10.2cc0: NT Headers: 0xe8
  491. 1a10.2cc0: Timestamp: 0x520398aa
  492. 1a10.2cc0: Machine: 0x8664 - amd64
  493. 1a10.2cc0: Timestamp: 0x520398aa
  494. 1a10.2cc0: Image Version: 6.0
  495. 1a10.2cc0: SizeOfImage: 0xc000 (49152)
  496. 1a10.2cc0: Resource Dir: 0xa000 LB 0x3a8
  497. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  498. 1a10.2cc0: ProductVersion: 8.10.0.41
  499. 1a10.2cc0: FileVersion: 8.10.0.41
  500. 1a10.2cc0: FileDescription: KLMOUFLT Mouse Device Filter [fre_wlh_x64]
  501. 1a10.2cc0: \SystemRoot\System32\drivers\kltdi.sys:
  502. 1a10.2cc0: CreationTime: 2014-03-25T20:26:04.000000000Z
  503. 1a10.2cc0: LastWriteTime: 2014-03-25T20:26:04.000000000Z
  504. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:23.685148400Z
  505. 1a10.2cc0: FileAttributes: 0x20
  506. 1a10.2cc0: Size: 0xda60
  507. 1a10.2cc0: NT Headers: 0x100
  508. 1a10.2cc0: Timestamp: 0x533175d2
  509. 1a10.2cc0: Machine: 0x8664 - amd64
  510. 1a10.2cc0: Timestamp: 0x533175d2
  511. 1a10.2cc0: Image Version: 6.1
  512. 1a10.2cc0: SizeOfImage: 0x10000 (65536)
  513. 1a10.2cc0: Resource Dir: 0xe000 LB 0x3b8
  514. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  515. 1a10.2cc0: ProductVersion: 1.7.0.5
  516. 1a10.2cc0: FileVersion: 1.7.0.5 built by: WinDDK
  517. 1a10.2cc0: FileDescription: Network filtering component [fre_wnet_amd64]
  518. 1a10.2cc0: \SystemRoot\System32\drivers\kneps.sys:
  519. 1a10.2cc0: CreationTime: 2014-03-26T21:05:28.000000000Z
  520. 1a10.2cc0: LastWriteTime: 2014-03-26T21:05:28.000000000Z
  521. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:23.793154500Z
  522. 1a10.2cc0: FileAttributes: 0x20
  523. 1a10.2cc0: Size: 0x2bc60
  524. 1a10.2cc0: NT Headers: 0x118
  525. 1a10.2cc0: Timestamp: 0x5332d05f
  526. 1a10.2cc0: Machine: 0x8664 - amd64
  527. 1a10.2cc0: Timestamp: 0x5332d05f
  528. 1a10.2cc0: Image Version: 6.1
  529. 1a10.2cc0: SizeOfImage: 0x2d000 (184320)
  530. 1a10.2cc0: Resource Dir: 0x2b000 LB 0x398
  531. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  532. 1a10.2cc0: ProductVersion: 5.7.0.7
  533. 1a10.2cc0: FileVersion: 5.7.0.7 built by: WinDDK
  534. 1a10.2cc0: FileDescription: KNEPS Power [fre_wnet_amd64]
  535. 1a10.2cc0: \SystemRoot\System32\klfphc.dll:
  536. 1a10.2cc0: CreationTime: 2014-09-04T14:40:23.778153700Z
  537. 1a10.2cc0: LastWriteTime: 2013-05-06T13:13:26.000000000Z
  538. 1a10.2cc0: ChangeTime: 2014-09-04T14:40:17.489544000Z
  539. 1a10.2cc0: FileAttributes: 0x20
  540. 1a10.2cc0: Size: 0x1ae60
  541. 1a10.2cc0: NT Headers: 0xe8
  542. 1a10.2cc0: Timestamp: 0x51873bf2
  543. 1a10.2cc0: Machine: 0x8664 - amd64
  544. 1a10.2cc0: Timestamp: 0x51873bf2
  545. 1a10.2cc0: Image Version: 0.0
  546. 1a10.2cc0: SizeOfImage: 0x1d000 (118784)
  547. 1a10.2cc0: Resource Dir: 0x18000 LB 0x3c80
  548. 1a10.2cc0: ProductName: Kaspersky™ Anti-Virus ®
  549. 1a10.2cc0: ProductVersion: 1.0.0.12
  550. 1a10.2cc0: FileVersion: 1.0.0.12
  551. 1a10.2cc0: FileDescription: Filtering Platform Helper Class
  552. 1a10.2cc0: Calling main()
  553. 1a10.2cc0: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  554. 1a10.2cc0: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  555. 1a10.2cc0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  556. 1a10.2cc0: SUPR3HardenedMain: Respawn #2
  557. 1a10.2cc0: supR3HardNtEnableThreadCreation:
  558. 1a10.2cc0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
  559. 1a10.2cc0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  560. 1a10.2cc0: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\apphelp.dll *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  561. 1a10.2cc0: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  562. 1a10.2cc0: supR3HardenedDllNotificationCallback: load 000007fefd6d0000 LB 0x00057000 A:\Windows\system32\apphelp.dll [fFlags=0x0]
  563. 1a10.2cc0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  564. 1a10.2cc0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6d0000 'A:\Windows\system32\apphelp.dll'
  565. 1a10.2cc0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000077aac340 pvNtTerminateThread=0000000077ad17e0
  566. 1a10.2cc0: supR3HardenedWinDoReSpawn(2): New child 14f8.8f8 [kernel32].
  567. 1a10.2cc0: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdc000 cbPeb=0x380
  568. 1a10.2cc0: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077a80000 uNtDllChildAddr=0000000077a80000
  569. 1a10.2cc0: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000077aac340
  570. 1a10.2cc0: supR3HardenedWinSetupChildInit: Start child.
  571. 1a10.2cc0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  572. 1a10.2cc0: supR3HardNtChildPurify: Startup delay kludge #1/0: 520 ms, 65 sleeps
  573. 1a10.2cc0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  574. 1a10.2cc0: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
  575. 1a10.2cc0: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
  576. 1a10.2cc0: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
  577. 1a10.2cc0: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
  578. 1a10.2cc0: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
  579. 1a10.2cc0: 0000000000041000-0000000000031fff 0x0001/0x0000 0x0000000
  580. 1a10.2cc0: *0000000000050000-000000000004efff 0x0004/0x0004 0x0020000
  581. 1a10.2cc0: 0000000000051000-ffffffffffeb1fff 0x0001/0x0000 0x0000000
  582. 1a10.2cc0: *00000000001f0000-00000000000f3fff 0x0000/0x0004 0x0020000
  583. 1a10.2cc0: 00000000002ec000-00000000002e8fff 0x0104/0x0004 0x0020000
  584. 1a10.2cc0: 00000000002ef000-00000000002edfff 0x0004/0x0004 0x0020000
  585. 1a10.2cc0: 00000000002f0000-ffffffff88b5ffff 0x0001/0x0000 0x0000000
  586. 1a10.2cc0: *0000000077a80000-0000000077a7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  587. 1a10.2cc0: 0000000077a81000-000000007797efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  588. 1a10.2cc0: 0000000077b83000-0000000077b53fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  589. 1a10.2cc0: 0000000077bb2000-0000000077ba9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  590. 1a10.2cc0: 0000000077bba000-0000000077bb8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  591. 1a10.2cc0: 0000000077bbb000-0000000077bb7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  592. 1a10.2cc0: 0000000077bbe000-0000000077b52fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  593. 1a10.2cc0: 0000000077c29000-0000000070871fff 0x0001/0x0000 0x0000000
  594. 1a10.2cc0: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
  595. 1a10.2cc0: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
  596. 1a10.2cc0: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
  597. 1a10.2cc0: 000000007fff0000-ffffffffc0c3ffff 0x0001/0x0000 0x0000000
  598. 1a10.2cc0: *000000013f3a0000-000000013f39efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  599. 1a10.2cc0: 000000013f3a1000-000000013f31cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  600. 1a10.2cc0: 000000013f425000-000000013f423fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  601. 1a10.2cc0: 000000013f426000-000000013f3e8fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  602. 1a10.2cc0: 000000013f463000-000000013f461fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  603. 1a10.2cc0: 000000013f464000-000000013f462fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  604. 1a10.2cc0: 000000013f465000-000000013f462fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  605. 1a10.2cc0: 000000013f467000-000000013f465fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  606. 1a10.2cc0: 000000013f468000-000000013f466fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  607. 1a10.2cc0: 000000013f469000-000000013f464fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  608. 1a10.2cc0: 000000013f46d000-000000013f433fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  609. 1a10.2cc0: 000000013f4a6000-fffff8037ebabfff 0x0001/0x0000 0x0000000
  610. 1a10.2cc0: *000007feffda0000-000007feffd9efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  611. 1a10.2cc0: 000007feffda1000-000007fdffb91fff 0x0001/0x0000 0x0000000
  612. 1a10.2cc0: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
  613. 1a10.2cc0: 000007fffffd3000-000007fffffc9fff 0x0001/0x0000 0x0000000
  614. 1a10.2cc0: *000007fffffdc000-000007fffffdafff 0x0004/0x0004 0x0020000
  615. 1a10.2cc0: 000007fffffdd000-000007fffffdbfff 0x0001/0x0000 0x0000000
  616. 1a10.2cc0: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
  617. 1a10.2cc0: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
  618. 1a10.2cc0: apisetschema.dll: timestamp 0x51fb15ca (rc=VINF_SUCCESS)
  619. 1a10.2cc0: VirtualBox.exe: timestamp 0x5439147c (rc=VINF_SUCCESS)
  620. 1a10.2cc0: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  621. 1a10.2cc0: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  622. 1a10.2cc0: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  623. 1a10.2cc0: supR3HardNtChildPurify: Done after 559 ms and 0 fixes (loop #0).
  624. 14f8.8f8: Log file opened: 4.3.18r96516 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110
  625. 14f8.8f8: supR3HardenedVmProcessInit: uNtDllAddr=0000000077a80000
  626. 14f8.8f8: ntdll.dll: timestamp 0x521eaf24 (rc=VINF_SUCCESS)
  627. 14f8.8f8: New simple heap: #1 00000000002f0000 LB 0x400000 (for 1740800 allocation)
  628. 1a10.2cc0: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000310000 LB 0x400000)
  629. 1a10.2cc0: supR3HardNtEnableThreadCreation:
  630. 14f8.8f8: System32: \Device\HarddiskVolume2\Windows\System32
  631. 14f8.8f8: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  632. 14f8.8f8: KnownDllPath: A:\Windows\system32
  633. 14f8.8f8: supR3HardenedVmProcessInit: Opening vboxdrv...
  634. 14f8.8f8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  635. 14f8.8f8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  636. 14f8.8f8: Registered Dll notification callback with NTDLL.
  637. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'kernel32.dll' -> 'A:\Windows\system32\kernel32.dll' [rcNt=0xc0150008]
  638. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  639. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  640. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\kernel32.dll *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  641. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  642. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000077960000 LB 0x0011f000 A:\Windows\system32\kernel32.dll [fFlags=0x0]
  643. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  644. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd900000 LB 0x0006c000 A:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  645. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  646. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  647. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077960000 'A:\Windows\system32\kernel32.dll'
  648. 14f8.8f8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000077aac340 pvNtTerminateThread=0000000077ad17e0
  649. 1a10.2cc0: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 58 ms.
  650. 14f8.8f8: \SystemRoot\System32\ntdll.dll:
  651. 14f8.8f8: CreationTime: 2014-01-28T09:07:34.178841200Z
  652. 14f8.8f8: LastWriteTime: 2013-08-29T02:16:35.515578900Z
  653. 14f8.8f8: ChangeTime: 2014-01-29T10:27:11.233869200Z
  654. 14f8.8f8: FileAttributes: 0x20
  655. 14f8.8f8: Size: 0x1a6dc0
  656. 14f8.8f8: NT Headers: 0xe0
  657. 14f8.8f8: Timestamp: 0x521eaf24
  658. 14f8.8f8: Machine: 0x8664 - amd64
  659. 14f8.8f8: Timestamp: 0x521eaf24
  660. 14f8.8f8: Image Version: 6.1
  661. 14f8.8f8: SizeOfImage: 0x1a9000 (1740800)
  662. 14f8.8f8: Resource Dir: 0x151000 LB 0x560d8
  663. 14f8.8f8: ProductName: Microsoft® Windows® Operating System
  664. 14f8.8f8: ProductVersion: 6.1.7601.18247
  665. 14f8.8f8: FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  666. 14f8.8f8: FileDescription: NT Layer DLL
  667. 14f8.8f8: \SystemRoot\System32\kernel32.dll:
  668. 14f8.8f8: CreationTime: 2014-04-08T21:52:30.104216500Z
  669. 14f8.8f8: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  670. 14f8.8f8: ChangeTime: 2014-04-09T12:16:53.175438800Z
  671. 14f8.8f8: FileAttributes: 0x20
  672. 14f8.8f8: Size: 0x11c000
  673. 14f8.8f8: NT Headers: 0xe8
  674. 14f8.8f8: Timestamp: 0x5315a059
  675. 14f8.8f8: Machine: 0x8664 - amd64
  676. 14f8.8f8: Timestamp: 0x5315a059
  677. 14f8.8f8: Image Version: 6.1
  678. 14f8.8f8: SizeOfImage: 0x11f000 (1175552)
  679. 14f8.8f8: Resource Dir: 0x116000 LB 0x528
  680. 14f8.8f8: ProductName: Microsoft® Windows® Operating System
  681. 14f8.8f8: ProductVersion: 6.1.7601.18409
  682. 14f8.8f8: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  683. 14f8.8f8: FileDescription: Windows NT BASE API Client DLL
  684. 14f8.8f8: \SystemRoot\System32\KernelBase.dll:
  685. 14f8.8f8: CreationTime: 2014-05-14T09:33:25.738973800Z
  686. 14f8.8f8: LastWriteTime: 2014-03-04T09:44:00.336000000Z
  687. 14f8.8f8: ChangeTime: 2014-05-15T03:47:18.721360200Z
  688. 14f8.8f8: FileAttributes: 0x20
  689. 14f8.8f8: Size: 0x67c00
  690. 14f8.8f8: NT Headers: 0xe8
  691. 14f8.8f8: Timestamp: 0x5315a05a
  692. 14f8.8f8: Machine: 0x8664 - amd64
  693. 14f8.8f8: Timestamp: 0x5315a05a
  694. 14f8.8f8: Image Version: 6.1
  695. 14f8.8f8: SizeOfImage: 0x6c000 (442368)
  696. 14f8.8f8: Resource Dir: 0x6a000 LB 0x530
  697. 14f8.8f8: ProductName: Microsoft® Windows® Operating System
  698. 14f8.8f8: ProductVersion: 6.1.7601.18409
  699. 14f8.8f8: FileVersion: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
  700. 14f8.8f8: FileDescription: Windows NT BASE API Client DLL
  701. 14f8.8f8: \SystemRoot\System32\apisetschema.dll:
  702. 14f8.8f8: CreationTime: 2014-01-28T09:08:32.878922200Z
  703. 14f8.8f8: LastWriteTime: 2013-08-02T02:12:20.275000000Z
  704. 14f8.8f8: ChangeTime: 2014-01-29T10:27:13.152672600Z
  705. 14f8.8f8: FileAttributes: 0x20
  706. 14f8.8f8: Size: 0x1a00
  707. 14f8.8f8: NT Headers: 0xc0
  708. 14f8.8f8: Timestamp: 0x51fb15ca
  709. 14f8.8f8: Machine: 0x8664 - amd64
  710. 14f8.8f8: Timestamp: 0x51fb15ca
  711. 14f8.8f8: Image Version: 6.1
  712. 14f8.8f8: SizeOfImage: 0x50000 (327680)
  713. 14f8.8f8: Resource Dir: 0x30000 LB 0x3f8
  714. 14f8.8f8: ProductName: Microsoft® Windows® Operating System
  715. 14f8.8f8: ProductVersion: 6.1.7601.18229
  716. 14f8.8f8: FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
  717. 14f8.8f8: FileDescription: ApiSet Schema DLL
  718. 14f8.8f8: Found driver klkbdflt (0x40)
  719. 14f8.8f8: Found driver KLIM6 (0x40)
  720. 14f8.8f8: Found driver klmouflt (0x40)
  721. 14f8.8f8: Found driver kl1 (0x40)
  722. 14f8.8f8: Found driver klflt (0x40)
  723. 14f8.8f8: Found driver kneps (0x40)
  724. 14f8.8f8: Found driver kltdi (0x40)
  725. 14f8.8f8: supR3HardenedWinFindAdversaries: 0x40
  726. 14f8.8f8: \SystemRoot\System32\drivers\kl1.sys:
  727. 14f8.8f8: CreationTime: 2014-02-20T16:59:04.000000000Z
  728. 14f8.8f8: LastWriteTime: 2014-02-20T16:59:04.000000000Z
  729. 14f8.8f8: ChangeTime: 2014-09-04T14:40:22.795097400Z
  730. 14f8.8f8: FileAttributes: 0x20
  731. 14f8.8f8: Size: 0x6fc60
  732. 14f8.8f8: NT Headers: 0xe0
  733. 14f8.8f8: Timestamp: 0x5305c3be
  734. 14f8.8f8: Machine: 0x8664 - amd64
  735. 14f8.8f8: Timestamp: 0x5305c3be
  736. 14f8.8f8: Image Version: 0.0
  737. 14f8.8f8: SizeOfImage: 0x75f000 (7729152)
  738. 14f8.8f8: Resource Dir: 0x75d000 LB 0x448
  739. 14f8.8f8: ProductName: Kaspersky Anti-Virus
  740. 14f8.8f8: ProductVersion: 6.0.1.990
  741. 14f8.8f8: FileVersion: 6.8.0.38
  742. 14f8.8f8: FileDescription: Kaspersky Unified Driver
  743. 14f8.8f8: \SystemRoot\System32\drivers\klflt.sys:
  744. 14f8.8f8: CreationTime: 2014-09-04T14:40:11.094178200Z
  745. 14f8.8f8: LastWriteTime: 2014-10-09T03:08:42.354945300Z
  746. 14f8.8f8: ChangeTime: 2014-10-09T03:08:47.605245600Z
  747. 14f8.8f8: FileAttributes: 0x20
  748. 14f8.8f8: Size: 0x22808
  749. 14f8.8f8: NT Headers: 0xf8
  750. 14f8.8f8: Timestamp: 0x540718a7
  751. 14f8.8f8: Machine: 0x8664 - amd64
  752. 14f8.8f8: Timestamp: 0x540718a7
  753. 14f8.8f8: Image Version: 6.0
  754. 14f8.8f8: SizeOfImage: 0x33000 (208896)
  755. 14f8.8f8: Resource Dir: 0x31000 LB 0x370
  756. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  757. 14f8.8f8: ProductVersion: 1.5.0.27
  758. 14f8.8f8: FileVersion: 1.5.0.27
  759. 14f8.8f8: FileDescription: Filter Core [fre_wlh_x64]
  760. 14f8.8f8: \SystemRoot\System32\drivers\klif.sys:
  761. 14f8.8f8: CreationTime: 2014-09-04T14:40:11.078177300Z
  762. 14f8.8f8: LastWriteTime: 2014-10-09T03:08:42.468951800Z
  763. 14f8.8f8: ChangeTime: 2014-10-09T03:08:47.619246400Z
  764. 14f8.8f8: FileAttributes: 0x20
  765. 14f8.8f8: Size: 0xc1cc8
  766. 14f8.8f8: NT Headers: 0x108
  767. 14f8.8f8: Timestamp: 0x542567a1
  768. 14f8.8f8: Machine: 0x8664 - amd64
  769. 14f8.8f8: Timestamp: 0x542567a1
  770. 14f8.8f8: Image Version: 6.0
  771. 14f8.8f8: SizeOfImage: 0xca000 (827392)
  772. 14f8.8f8: Resource Dir: 0xc7000 LB 0x1240
  773. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  774. 14f8.8f8: ProductVersion: 8.15.0.241
  775. 14f8.8f8: FileVersion: 8.15.0.241
  776. 14f8.8f8: FileDescription: Klif Mini-Filter [fre_wlh_x64]
  777. 14f8.8f8: \SystemRoot\System32\drivers\klim6.sys:
  778. 14f8.8f8: CreationTime: 2014-02-25T17:09:02.000000000Z
  779. 14f8.8f8: LastWriteTime: 2014-02-25T17:09:02.000000000Z
  780. 14f8.8f8: ChangeTime: 2014-09-04T14:40:22.567084400Z
  781. 14f8.8f8: FileAttributes: 0x20
  782. 14f8.8f8: Size: 0x7660
  783. 14f8.8f8: NT Headers: 0x100
  784. 14f8.8f8: Timestamp: 0x530c5da9
  785. 14f8.8f8: Machine: 0x8664 - amd64
  786. 14f8.8f8: Timestamp: 0x530c5da9
  787. 14f8.8f8: Image Version: 6.0
  788. 14f8.8f8: SizeOfImage: 0xa000 (40960)
  789. 14f8.8f8: Resource Dir: 0x8000 LB 0x470
  790. 14f8.8f8: ProductName: Kaspersky Anti-Virus
  791. 14f8.8f8: ProductVersion: 6.0.1.990
  792. 14f8.8f8: FileVersion: 8.0.0.83
  793. 14f8.8f8: FileDescription: Kaspersky Lab Intermediate Network Driver
  794. 14f8.8f8: \SystemRoot\System32\drivers\klkbdflt.sys:
  795. 14f8.8f8: CreationTime: 2014-03-28T21:51:04.000000000Z
  796. 14f8.8f8: LastWriteTime: 2014-03-28T21:51:04.000000000Z
  797. 14f8.8f8: ChangeTime: 2014-09-04T14:40:23.463135700Z
  798. 14f8.8f8: FileAttributes: 0x20
  799. 14f8.8f8: Size: 0x7060
  800. 14f8.8f8: NT Headers: 0xf8
  801. 14f8.8f8: Timestamp: 0x53357e3c
  802. 14f8.8f8: Machine: 0x8664 - amd64
  803. 14f8.8f8: Timestamp: 0x53357e3c
  804. 14f8.8f8: Image Version: 6.0
  805. 14f8.8f8: SizeOfImage: 0xc000 (49152)
  806. 14f8.8f8: Resource Dir: 0xa000 LB 0x3a8
  807. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  808. 14f8.8f8: ProductVersion: 8.14.0.13
  809. 14f8.8f8: FileVersion: 8.14.0.13
  810. 14f8.8f8: FileDescription: KLKBDFLT Keyboard Device Filter [fre_wlh_x64]
  811. 14f8.8f8: \SystemRoot\System32\drivers\klmouflt.sys:
  812. 14f8.8f8: CreationTime: 2013-08-08T21:11:00.000000000Z
  813. 14f8.8f8: LastWriteTime: 2013-08-08T21:11:00.000000000Z
  814. 14f8.8f8: ChangeTime: 2014-09-04T14:40:23.365130100Z
  815. 14f8.8f8: FileAttributes: 0x20
  816. 14f8.8f8: Size: 0x7260
  817. 14f8.8f8: NT Headers: 0xe8
  818. 14f8.8f8: Timestamp: 0x520398aa
  819. 14f8.8f8: Machine: 0x8664 - amd64
  820. 14f8.8f8: Timestamp: 0x520398aa
  821. 14f8.8f8: Image Version: 6.0
  822. 14f8.8f8: SizeOfImage: 0xc000 (49152)
  823. 14f8.8f8: Resource Dir: 0xa000 LB 0x3a8
  824. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  825. 14f8.8f8: ProductVersion: 8.10.0.41
  826. 14f8.8f8: FileVersion: 8.10.0.41
  827. 14f8.8f8: FileDescription: KLMOUFLT Mouse Device Filter [fre_wlh_x64]
  828. 14f8.8f8: \SystemRoot\System32\drivers\kltdi.sys:
  829. 14f8.8f8: CreationTime: 2014-03-25T20:26:04.000000000Z
  830. 14f8.8f8: LastWriteTime: 2014-03-25T20:26:04.000000000Z
  831. 14f8.8f8: ChangeTime: 2014-09-04T14:40:23.685148400Z
  832. 14f8.8f8: FileAttributes: 0x20
  833. 14f8.8f8: Size: 0xda60
  834. 14f8.8f8: NT Headers: 0x100
  835. 14f8.8f8: Timestamp: 0x533175d2
  836. 14f8.8f8: Machine: 0x8664 - amd64
  837. 14f8.8f8: Timestamp: 0x533175d2
  838. 14f8.8f8: Image Version: 6.1
  839. 14f8.8f8: SizeOfImage: 0x10000 (65536)
  840. 14f8.8f8: Resource Dir: 0xe000 LB 0x3b8
  841. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  842. 14f8.8f8: ProductVersion: 1.7.0.5
  843. 14f8.8f8: FileVersion: 1.7.0.5 built by: WinDDK
  844. 14f8.8f8: FileDescription: Network filtering component [fre_wnet_amd64]
  845. 14f8.8f8: \SystemRoot\System32\drivers\kneps.sys:
  846. 14f8.8f8: CreationTime: 2014-03-26T21:05:28.000000000Z
  847. 14f8.8f8: LastWriteTime: 2014-03-26T21:05:28.000000000Z
  848. 14f8.8f8: ChangeTime: 2014-09-04T14:40:23.793154500Z
  849. 14f8.8f8: FileAttributes: 0x20
  850. 14f8.8f8: Size: 0x2bc60
  851. 14f8.8f8: NT Headers: 0x118
  852. 14f8.8f8: Timestamp: 0x5332d05f
  853. 14f8.8f8: Machine: 0x8664 - amd64
  854. 14f8.8f8: Timestamp: 0x5332d05f
  855. 14f8.8f8: Image Version: 6.1
  856. 14f8.8f8: SizeOfImage: 0x2d000 (184320)
  857. 14f8.8f8: Resource Dir: 0x2b000 LB 0x398
  858. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  859. 14f8.8f8: ProductVersion: 5.7.0.7
  860. 14f8.8f8: FileVersion: 5.7.0.7 built by: WinDDK
  861. 14f8.8f8: FileDescription: KNEPS Power [fre_wnet_amd64]
  862. 14f8.8f8: \SystemRoot\System32\klfphc.dll:
  863. 14f8.8f8: CreationTime: 2014-09-04T14:40:23.778153700Z
  864. 14f8.8f8: LastWriteTime: 2013-05-06T13:13:26.000000000Z
  865. 14f8.8f8: ChangeTime: 2014-09-04T14:40:17.489544000Z
  866. 14f8.8f8: FileAttributes: 0x20
  867. 14f8.8f8: Size: 0x1ae60
  868. 14f8.8f8: NT Headers: 0xe8
  869. 14f8.8f8: Timestamp: 0x51873bf2
  870. 14f8.8f8: Machine: 0x8664 - amd64
  871. 14f8.8f8: Timestamp: 0x51873bf2
  872. 14f8.8f8: Image Version: 0.0
  873. 14f8.8f8: SizeOfImage: 0x1d000 (118784)
  874. 14f8.8f8: Resource Dir: 0x18000 LB 0x3c80
  875. 14f8.8f8: ProductName: Kaspersky™ Anti-Virus ®
  876. 14f8.8f8: ProductVersion: 1.0.0.12
  877. 14f8.8f8: FileVersion: 1.0.0.12
  878. 14f8.8f8: FileDescription: Filtering Platform Helper Class
  879. 14f8.8f8: Calling main()
  880. 14f8.8f8: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  881. 14f8.8f8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  882. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  883. 14f8.8f8: SUPR3HardenedMain: Final process, opening VBoxDrv...
  884. 14f8.8f8: supR3HardenedEarlyCompact: Removed heap 1 (0x000000002f0000 LB 0x400000)
  885. 14f8.8f8: supR3HardNtEnableThreadCreation:
  886. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  887. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  888. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL *pfFlags=0x0 pwszSearchPath=00000000008e4430:A:\Windows\system32 [calling]
  889. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  890. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fedcff0000 LB 0x00004000 A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  891. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  892. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  893. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  894. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fedcff0000 'A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  895. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  896. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  897. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fedcff0000 'A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  898. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fedcff0000 'A:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  899. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  900. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
  901. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  902. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  903. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
  904. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  905. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  906. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  907. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
  908. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  909. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  910. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  911. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
  912. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
  913. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  914. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  915. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  916. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  917. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
  918. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  919. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  920. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  921. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
  922. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  923. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  924. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  925. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  926. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  927. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  928. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  929. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\Wintrust.dll *pfFlags=0x0 pwszSearchPath=00000000008e4430:A:\Windows\system32 [calling]
  930. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  931. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd8c0000 LB 0x0003b000 A:\Windows\system32\Wintrust.dll [fFlags=0x0]
  932. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  933. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefeed0000 LB 0x0009f000 A:\Windows\system32\msvcrt.dll [fFlags=0x0]
  934. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  935. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd980000 LB 0x0016d000 A:\Windows\system32\CRYPT32.dll [fFlags=0x0]
  936. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  937. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd8a0000 LB 0x0000f000 A:\Windows\system32\MSASN1.dll [fFlags=0x0]
  938. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  939. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefe9e0000 LB 0x0012d000 A:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  940. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  941. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd8c0000 'A:\Windows\system32\Wintrust.dll'
  942. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CRYPTSP.dll' -> 'A:\Windows\system32\CRYPTSP.dll' [rcNt=0xc0150008]
  943. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
  944. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  945. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPTSP.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  946. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  947. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd0d0000 LB 0x00018000 A:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
  948. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  949. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'A:\Windows\system32\CRYPTSP.dll'
  950. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  951. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
  952. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
  953. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  954. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  955. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  956. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\rsaenh.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  957. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  958. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefcdd0000 LB 0x00047000 A:\Windows\system32\rsaenh.dll [fFlags=0x0]
  959. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  960. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcdd0000 'A:\Windows\system32\rsaenh.dll'
  961. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ADVAPI32.dll' -> 'A:\Windows\system32\ADVAPI32.dll' [rcNt=0xc0150008]
  962. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  963. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  964. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
  965. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  966. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  967. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  968. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  969. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  970. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  971. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  972. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ADVAPI32.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  973. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  974. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff760000 LB 0x000db000 A:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
  975. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  976. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  977. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  978. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
  979. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
  980. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff660000 LB 0x0001f000 A:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  981. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  982. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\ADVAPI32.dll'
  983. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CRYPTBASE.dll' -> 'A:\Windows\system32\CRYPTBASE.dll' [rcNt=0xc0150008]
  984. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
  985. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  986. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  987. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  988. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  989. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  990. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  991. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  992. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPTBASE.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  993. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  994. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd730000 LB 0x0000f000 A:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
  995. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  996. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd730000 'A:\Windows\system32\CRYPTBASE.dll'
  997. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'kernel32.dll' -> 'A:\Windows\system32\kernel32.dll' [rcNt=0xc0150008]
  998. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  999. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\kernel32.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1000. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077960000 'A:\Windows\system32\kernel32.dll'
  1001. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'WINTRUST.DLL' -> 'A:\Windows\system32\WINTRUST.DLL' [rcNt=0xc0150008]
  1002. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  1003. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\WINTRUST.DLL *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1004. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd8c0000 'A:\Windows\system32\WINTRUST.DLL'
  1005. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1006. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPT32.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1007. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd980000 'A:\Windows\system32\CRYPT32.dll'
  1008. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'imagehlp.dll' -> 'A:\Windows\system32\imagehlp.dll' [rcNt=0xc0150008]
  1009. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1010. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'advapi32.dll'.
  1011. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
  1012. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1013. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1014. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1015. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1016. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1017. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1018. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1019. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\imagehlp.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1020. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1021. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feffd70000 LB 0x00019000 A:\Windows\system32\imagehlp.dll [fFlags=0x0]
  1022. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1023. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feffd70000 'A:\Windows\system32\imagehlp.dll'
  1024. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CRYPTSP.dll' -> 'A:\Windows\system32\CRYPTSP.dll' [rcNt=0xc0150008]
  1025. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1026. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPTSP.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1027. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'A:\Windows\system32\CRYPTSP.dll'
  1028. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'USER32.dll' -> 'A:\Windows\system32\USER32.dll' [rcNt=0xc0150008]
  1029. 14f8.8f8: \Device\HarddiskVolume2\Windows\System32\user32.dll: Owner is administrators group.
  1030. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1031. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
  1032. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
  1033. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1034. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1035. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1036. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
  1037. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
  1038. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1039. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
  1040. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume2\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
  1041. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1042. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1043. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
  1044. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\lpk.dll)
  1045. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\lpk.dll
  1046. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1047. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1048. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1049. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
  1050. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume2\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
  1051. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1052. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1053. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  1054. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\usp10.dll)
  1055. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\usp10.dll
  1056. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1057. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1058. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1059. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1060. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1061. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1062. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1063. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1064. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1065. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1066. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1067. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1068. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1069. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1070. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1071. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\USER32.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1072. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1073. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000077490000 LB 0x000fa000 A:\Windows\system32\USER32.dll [fFlags=0x0]
  1074. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1075. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefef70000 LB 0x00067000 A:\Windows\system32\GDI32.dll [fFlags=0x0]
  1076. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1077. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff530000 LB 0x0000e000 A:\Windows\system32\LPK.dll [fFlags=0x0]
  1078. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\lpk.dll [lacks WinVerifyTrust]
  1079. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feffc90000 LB 0x000c9000 A:\Windows\system32\USP10.dll [fFlags=0x0]
  1080. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\usp10.dll [lacks WinVerifyTrust]
  1081. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'gdi32.dll' -> 'A:\Windows\system32\gdi32.dll' [rcNt=0xc0150008]
  1082. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1083. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\gdi32.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1084. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefef70000 'A:\Windows\system32\gdi32.dll'
  1085. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1086. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1087. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
  1088. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
  1089. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
  1090. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
  1091. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
  1092. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1093. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1094. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  1095. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
  1096. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
  1097. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
  1098. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1099. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1100. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1101. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1102. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1103. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1104. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1105. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1106. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1107. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1108. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1109. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1110. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1111. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1112. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1113. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1114. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1115. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1116. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\IMM32.DLL *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1117. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1118. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff1f0000 LB 0x0002e000 A:\Windows\system32\IMM32.DLL [fFlags=0x0]
  1119. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1120. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefed40000 LB 0x00109000 A:\Windows\system32\MSCTF.dll [fFlags=0x0]
  1121. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [lacks WinVerifyTrust]
  1122. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff1f0000 'A:\Windows\system32\IMM32.DLL'
  1123. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077490000 'A:\Windows\system32\USER32.dll'
  1124. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ncrypt.dll' -> 'A:\Windows\system32\ncrypt.dll' [rcNt=0xc0150008]
  1125. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
  1126. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1127. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
  1128. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ncrypt.dll)
  1129. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1130. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  1131. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  1132. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  1133. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1134. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1135. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1136. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1137. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1138. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
  1139. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  1140. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ncrypt.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1141. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1142. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd250000 LB 0x0004d000 A:\Windows\system32\ncrypt.dll [fFlags=0x0]
  1143. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1144. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1145. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd220000 LB 0x00022000 A:\Windows\system32\bcrypt.dll [fFlags=0x0]
  1146. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1147. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd250000 'A:\Windows\system32\ncrypt.dll'
  1148. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  1149. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
  1150. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
  1151. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
  1152. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1153. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1154. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1155. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1156. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1157. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1158. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\bcryptprimitives.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1159. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  1160. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefccc0000 LB 0x0004c000 A:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
  1161. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  1162. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccc0000 'A:\Windows\system32\bcryptprimitives.dll'
  1163. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'bcrypt.dll' -> 'A:\Windows\system32\bcrypt.dll' [rcNt=0xc0150008]
  1164. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1165. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\bcrypt.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1166. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd220000 'A:\Windows\system32\bcrypt.dll'
  1167. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'USERENV.dll' -> 'A:\Windows\system32\USERENV.dll' [rcNt=0xc0150008]
  1168. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1169. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  1170. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
  1171. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\userenv.dll)
  1172. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
  1173. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1174. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1175. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1176. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
  1177. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
  1178. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1179. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1180. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1181. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1182. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1183. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1184. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1185. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1186. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1187. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\USERENV.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1188. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1189. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefdbb0000 LB 0x0001e000 A:\Windows\system32\USERENV.dll [fFlags=0x0]
  1190. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1191. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd890000 LB 0x0000f000 A:\Windows\system32\profapi.dll [fFlags=0x0]
  1192. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1193. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdbb0000 'A:\Windows\system32\USERENV.dll'
  1194. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1195. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1196. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1197. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1198. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'GPAPI.dll' -> 'A:\Windows\system32\GPAPI.dll' [rcNt=0xc0150008]
  1199. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1200. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1201. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
  1202. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1203. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1204. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1205. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1206. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1207. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1208. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1209. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\GPAPI.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1210. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1211. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefcb00000 LB 0x0001b000 A:\Windows\system32\GPAPI.dll [fFlags=0x0]
  1212. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1213. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcb00000 'A:\Windows\system32\GPAPI.dll'
  1214. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1215. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1216. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'rpcrt4.dll' -> 'A:\Windows\system32\rpcrt4.dll' [rcNt=0xc0150008]
  1217. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1218. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\rpcrt4.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1219. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe9e0000 'A:\Windows\system32\rpcrt4.dll'
  1220. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1221. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-WIN-Service-Management-L2-1-0.dll'
  1222. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1223. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1224. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'cryptnet.dll' -> 'A:\Windows\system32\cryptnet.dll' [rcNt=0xc0150008]
  1225. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1226. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1227. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  1228. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'wldap32.dll'.
  1229. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
  1230. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1231. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
  1232. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
  1233. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1234. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\Wldap32.dll)
  1235. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1236. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  1237. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  1238. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1239. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1240. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1241. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1242. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1243. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1244. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1245. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1246. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1247. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1248. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1249. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1250. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fef8f00000 LB 0x00027000 A:\Windows\system32\cryptnet.dll [fFlags=0x0]
  1251. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1252. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff4d0000 LB 0x00052000 A:\Windows\system32\WLDAP32.dll [fFlags=0x0]
  1253. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
  1254. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1255. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1256. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1257. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1258. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1259. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1260. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1261. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1262. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1263. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1264. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1265. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1266. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1267. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1268. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1269. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1270. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1271. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1272. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1273. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1274. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1275. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1276. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1277. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1278. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1279. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1280. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1281. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1282. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1283. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1284. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1285. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x1002 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1286. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1287. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1288. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'cryptnet.dll' -> 'A:\Windows\system32\cryptnet.dll' [rcNt=0xc0150008]
  1289. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1290. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\cryptnet.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1291. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef8f00000 'A:\Windows\system32\cryptnet.dll'
  1292. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1293. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1294. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'profapi.dll' -> 'A:\Windows\system32\profapi.dll' [rcNt=0xc0150008]
  1295. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1296. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\profapi.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1297. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd890000 'A:\Windows\system32\profapi.dll'
  1298. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'SHLWAPI.dll' -> 'A:\Windows\system32\SHLWAPI.dll' [rcNt=0xc0150008]
  1299. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1300. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1301. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  1302. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
  1303. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1304. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1305. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1306. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1307. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1308. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1309. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1310. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1311. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1312. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1313. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\SHLWAPI.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1314. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1315. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefee50000 LB 0x00071000 A:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
  1316. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1317. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefee50000 'A:\Windows\system32\SHLWAPI.dll'
  1318. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  1319. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000009b6a50
  1320. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1321. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=771D512B7B1C39F0393BD4EF9FC62F442783FB35
  1322. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1323. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1324. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1325. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1326. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1327. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
  1328. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ADVAPI32.dll' -> 'A:\Windows\system32\ADVAPI32.dll' [rcNt=0xc0150008]
  1329. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1330. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ADVAPI32.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1331. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\ADVAPI32.dll'
  1332. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1333. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1334. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1335. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff660000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1336. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\SystemRoot\System32\ntdll.dll'
  1337. 14f8.8f8: g_pfnWinVerifyTrust=000007fefd8c1010
  1338. 14f8.8f8: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  1339. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e0 pwszName=\Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1340. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1341. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1342. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E4581771CBFFF32DF331EF17B5C5FD7E1F614302
  1343. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_136_for_KB2949927~31bf3856ad364e35~amd64~~6.1.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1344. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1345. 14f8.8f8: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1346. 14f8.8f8: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  1347. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d4 pwszName=\Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1348. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1349. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1350. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=108407301192217C74BC9FE609CA642A66DBE98B
  1351. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_91_for_KB2949927~31bf3856ad364e35~amd64~~6.1.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1352. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1353. 14f8.8f8: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1354. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003c0 pwszName=\Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1355. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1356. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1357. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB8D9C9D3E1FC95D01F9A984B16ED031BB40CD8
  1358. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1359. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1360. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1361. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b4 pwszName=\Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1362. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1363. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1364. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87E73086F2528CF31D3AD5F0D71E04F8B942D5D8
  1365. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1366. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1367. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1368. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b0 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1369. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1370. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1371. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C1C670A9871F2BD448B2F0FA6127AC7A486B8D8F
  1372. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_91_for_KB2949927~31bf3856ad364e35~amd64~~6.1.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1373. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1374. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1375. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000026c pwszName=\Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1376. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1377. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1378. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=470795C189226F7BDB8E50F42104CC34488B9340
  1379. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1380. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1381. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1382. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001d8 pwszName=\Device\HarddiskVolume2\Windows\System32\profapi.dll
  1383. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1384. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1385. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
  1386. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1387. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1388. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1389. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001d4 pwszName=\Device\HarddiskVolume2\Windows\System32\userenv.dll
  1390. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1391. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1392. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3E1A2CC7367F751C19EBF4E6EDF5E9A10E47313
  1393. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1394. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1395. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1396. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
  1397. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001ac pwszName=\Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  1398. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1399. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1400. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62E377A1F0AD0C2EDC0A73CB3EFF841FF18D00D2
  1401. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1402. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1403. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1404. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001a8 pwszName=\Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1405. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1406. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1407. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=79EA9CBEF21789D2261F797DD2A1624A054306AB
  1408. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_52_for_KB2973337~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1409. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1410. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1411. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000190 pwszName=\Device\HarddiskVolume2\Windows\System32\msctf.dll
  1412. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1413. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1414. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=803AF52F95A9EFDFDA06C595023831EE36ACD3A8
  1415. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1416. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1417. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1418. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000018c pwszName=\Device\HarddiskVolume2\Windows\System32\imm32.dll
  1419. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1420. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1421. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6EEE1AB3B6D79AFF857940FF5F51ED27698153EC
  1422. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1423. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1424. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1425. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000188 pwszName=\Device\HarddiskVolume2\Windows\System32\usp10.dll
  1426. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1427. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1428. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1F1AA8340DE02FC1B6341EE2706E55D56EDF63B8
  1429. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2957509~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1430. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1431. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1432. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000184 pwszName=\Device\HarddiskVolume2\Windows\System32\lpk.dll
  1433. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1434. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1435. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6FCA4D678614C8615E6E5C082BF3A4562FCF14EB
  1436. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2847311~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1437. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1438. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1439. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000180 pwszName=\Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1440. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1441. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1442. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AEB59C2353484ADF282BEA358113ABD82C223B9
  1443. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2993651~31bf3856ad364e35~amd64~~6.1.1.3.cat'; file='\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1444. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1445. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1446. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume2\Windows\System32\user32.dll
  1447. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009b6a50
  1448. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009b6a50
  1449. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1450. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1451. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: New context 0000000003084350
  1452. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1453. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1454. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1455. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: New context 0000000003084410
  1456. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084410
  1457. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=7458187B83265348D287AC7AB34C0A5AD0EFDAA5040E43F37D2AC3DBEB747E20
  1458. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1459. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1460. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: -22900 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
  1461. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000174 pwszName=\Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1462. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1463. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1464. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2702EE05F1B717B0F2CE0FBE32784A47B8419DCA
  1465. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB2893294~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1466. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1467. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1468. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000120 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1469. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1470. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1471. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A965CC5DB13A5FB23BBB1B6B5FA6D400DC49462F
  1472. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1473. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1474. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1475. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000114 pwszName=\Device\HarddiskVolume2\Windows\System32\sechost.dll
  1476. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1477. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1478. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3FA2A014BF360CDC0E203A174FFC9DC5343C5323
  1479. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1480. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1481. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1482. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000108 pwszName=\Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1483. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1484. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1485. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7C0A1C638CE7C1160F49C473EC1420BD3AB693C4
  1486. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1487. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1488. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1489. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
  1490. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  1491. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1492. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1493. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FE601E1BC89E11CA16D1CA31315BC348EFAF0C74
  1494. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_91_for_KB2949927~31bf3856ad364e35~amd64~~6.1.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1495. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1496. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1497. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e4 pwszName=\Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1498. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1499. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1500. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2CA2FD632B264C063162F71474266E3615B6420C
  1501. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2654428~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1502. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1503. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1504. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000dc pwszName=\Device\HarddiskVolume2\Windows\System32\msasn1.dll
  1505. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1506. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1507. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F2FF57DC30D774F93061607060DAA0DD15E39CCE
  1508. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1509. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1510. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1511. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d8 pwszName=\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1512. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1513. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1514. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=03E871CFC4A3E7194619AFC99CEEA1EC75982D12
  1515. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2978668~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1516. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1517. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1518. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1519. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  1520. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1521. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1522. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=57EB6F834C5A5D9585A660D91756134028A3B089
  1523. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_54_for_KB2871997~31bf3856ad364e35~amd64~~6.1.2.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1524. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1525. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1526. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume2\Windows\System32\kernel32.dll
  1527. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1528. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1529. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5349346AE66DA4E3A7206628F484AC3B3AA43776
  1530. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_54_for_KB2871997~31bf3856ad364e35~amd64~~6.1.2.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1531. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1532. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1533. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1534. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\crypt32.dll *pfFlags=0x0 pwszSearchPath=0000000000ed9b00:A:\Windows\system32 [calling]
  1535. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd980000 'A:\Windows\system32\crypt32.dll'
  1536. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1537. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1538. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1539. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1540. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1541. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x2b0db9dc6e00ba00 O=Kaspersky Lab ZAO, CN=Kaspersky Anti-Virus Personal Root Certificate
  1542. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  1543. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x1136cb82ff85af00 O=Kaspersky Lab ZAO, CN=Kaspersky Anti-Virus Personal Root Certificate
  1544. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=BZ, ST=Belize, L=Belize city, O=Disc Soft Ltd, CN=Disc Soft Ltd, Email=finpr@disc-soft.com
  1545. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1546. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1547. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1548. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
  1549. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  1550. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1551. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1552. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  1553. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  1554. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  1555. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1556. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1557. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1558. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1559. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x3178d37f87f1c400 C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2
  1560. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xff3891b54348328 C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
  1561. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1562. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1563. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1564. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  1565. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xabd0695c5d11d15e C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
  1566. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1567. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1568. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x35f812d09650dc00 C=FR, O=Certplus, CN=Class 2 Primary CA
  1569. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xab549401526569d3 L=Internet, O=VeriSign, Inc., OU=VeriSign Commercial Software Publishers CA
  1570. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
  1571. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  1572. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1573. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  1574. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x6e2ba21058eedf00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC
  1575. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1576. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1577. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1578. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  1579. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  1580. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x30669a4e82fa800 C=US, O=America Online Inc., CN=America Online Root Certification Authority 1
  1581. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1582. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  1583. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x20b7075b3689b600 C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2
  1584. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x9259c8abe5ca713a L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com/, Email=info@valicert.com
  1585. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1586. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xab549401526569d3 L=Internet, O=VeriSign, Inc., OU=VeriSign Commercial Software Publishers CA
  1587. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xe66b56ffc86e50a4 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA, Email=server-certs@thawte.com
  1588. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
  1589. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1590. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xa8b43f38c3f7b100 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware
  1591. 14f8.8f8: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1592. 14f8.8f8: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=55
  1593. 14f8.8f8: SUPR3HardenedMain: Load Runtime...
  1594. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1595. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1596. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  1597. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  1598. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll)WinVerifyTrust
  1599. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1600. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1601. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1602. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1603. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1604. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1605. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000434 pwszName=\Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1606. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1607. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1608. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3EF3BDC1E84DFA17EA056313214EE88EC3E66F79
  1609. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ws2_32.dll'
  1610. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1611. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1612. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1613. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
  1614. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll)WinVerifyTrust
  1615. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1616. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1617. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1618. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1619. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll)WinVerifyTrust
  1620. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1621. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1622. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1623. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll)WinVerifyTrust
  1624. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1625. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1626. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1627. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1628. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  1629. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  1630. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000458 pwszName=\Device\HarddiskVolume2\Windows\System32\nsi.dll
  1631. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1632. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1633. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AFD8538945F2D05BC1AF949B9B19B7D2D9FBBF8
  1634. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\nsi.dll'
  1635. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1636. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll)WinVerifyTrust
  1637. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1638. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1639. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1640. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1641. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1642. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1643. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1644. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  1645. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1646. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fed81d0000 LB 0x0052f000 A:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1647. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1648. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1649. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000058ef0000 LB 0x000d2000 A:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1650. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1651. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1652. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000058e50000 LB 0x00098000 A:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1653. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1654. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefecf0000 LB 0x0004d000 A:\Windows\system32\WS2_32.dll [fFlags=0x0]
  1655. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1656. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feffd60000 LB 0x00008000 A:\Windows\system32\NSI.dll [fFlags=0x0]
  1657. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1658. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1659. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1660. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1661. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1662. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1663. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1664. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1665. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1666. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1667. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1668. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1669. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1670. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1671. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1672. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1673. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1674. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1675. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1676. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1677. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1678. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1679. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1680. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1681. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1682. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1683. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1684. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1685. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1686. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1687. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1688. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1689. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1690. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1691. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1692. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1693. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1694. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1695. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1696. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1697. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1698. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1699. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1700. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1701. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1702. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1703. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1704. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1705. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1706. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1707. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1708. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1709. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1710. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1711. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1712. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1713. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1714. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1715. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1716. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1717. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1718. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1719. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1720. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1721. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1722. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1723. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1724. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1725. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1726. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1727. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1728. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1729. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1730. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1731. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1732. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1733. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1734. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1735. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1736. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1737. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1738. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1739. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1740. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1741. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1742. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1743. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1744. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1745. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1746. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1747. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1748. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1749. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1750. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1751. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1752. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxRT.dll *pfFlags=0x0 pwszSearchPath=00000000008e4c40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32;A:\Windows\system;A:\Windows;.;A:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;A:\ProgramData\Oracle\Java\javapath;A:\Program Files\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;A:\Program Files (x86)\Common Files\NetSarang;A:\Windows\system32;A:\Windows;A:\Windows\System32\Wbem;A:\Windows\System32\WindowsPowerShell\v1.0\;A:\Program Files (x86)\Windows Live\Shared;A:\oclhashcat;A:\dig\bin;A:\WINDOWS\SysWOW64\dns\bin;A:\dig;A:\Program Files (x86)\Nmap;A:\Program Files\oclhashcat;A:\dig\bin [calling]
  1753. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1754. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed81d0000 'A:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1755. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1756. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\Wintrust.dll *pfFlags=0x0 pwszSearchPath=0000000000f74c70:A:\Windows\system32 [calling]
  1757. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd8c0000 'A:\Windows\system32\Wintrust.dll'
  1758. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1759. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\crypt32.dll *pfFlags=0x0 pwszSearchPath=0000000000f74c70:A:\Windows\system32 [calling]
  1760. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd980000 'A:\Windows\system32\crypt32.dll'
  1761. 14f8.8f8: SUPR3HardenedMain: Load TrustedMain...
  1762. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1763. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1764. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  1765. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1766. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qtcorevbox4.dll'.
  1767. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qtguivbox4.dll'.
  1768. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qtnetworkvbox4.dll'.
  1769. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qtopenglvbox4.dll'.
  1770. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'user32.dll'.
  1771. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'gdi32.dll'.
  1772. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  1773. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  1774. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  1775. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  1776. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'comdlg32.dll'.
  1777. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'winmm.dll'.
  1778. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll)WinVerifyTrust
  1779. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1780. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1781. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1782. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000048c pwszName=\Device\HarddiskVolume2\Windows\System32\winmm.dll
  1783. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1784. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1785. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82E2B2A7826F88BEB98FFF0540C9BDB0A12F001A
  1786. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\winmm.dll'
  1787. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1788. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1789. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1790. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll)WinVerifyTrust
  1791. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1792. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  1793. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  1794. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000046c pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  1795. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1796. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1797. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=66EE5BDFFA413AEA9E1FE7838A08646E94136DA5
  1798. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
  1799. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1800. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1801. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
  1802. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1803. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1804. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
  1805. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  1806. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll)WinVerifyTrust
  1807. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  1808. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1809. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1810. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000480 pwszName=\Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1811. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1812. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1813. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C1D7CC9111C6B5A59641FA11BE0A6A1841FEBBCD
  1814. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2564958~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1815. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1816. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1817. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1818. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1819. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1820. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1821. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll)WinVerifyTrust
  1822. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1823. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1824. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1825. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000498 pwszName=\Device\HarddiskVolume2\Windows\System32\ole32.dll
  1826. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1827. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1828. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E64AE329BD5124592BC8CB0B327AA3B95DC65B7
  1829. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1830. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1831. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1832. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1833. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
  1834. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1835. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ole32.dll)WinVerifyTrust
  1836. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1837. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1838. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1839. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000490 pwszName=\Device\HarddiskVolume2\Windows\System32\shell32.dll
  1840. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1841. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1842. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8D11B9B481EE916E64C94F8ECA71C2995A2999B7
  1843. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB2980245~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\shell32.dll'
  1844. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1845. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1846. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'shlwapi.dll'.
  1847. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
  1848. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
  1849. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll)WinVerifyTrust
  1850. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1851. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1852. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1853. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1854. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1855. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1856. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1857. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1858. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1859. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  1860. 14f8.8f8: Error (rc=0):
  1861. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=1 \Device\HarddiskVolume2\Windows\System32\user32.dll
  1862. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtopenglvbox4.dll'...
  1863. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtopenglvbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtopenglvbox4.dll' [rcNtRedir=0xc0150008]
  1864. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1865. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1866. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1867. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qtguivbox4.dll'.
  1868. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qtcorevbox4.dll'.
  1869. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcr100.dll'.
  1870. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtOpenGLVBox4.dll)WinVerifyTrust
  1871. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtOpenGLVBox4.dll
  1872. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtnetworkvbox4.dll'...
  1873. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtnetworkvbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtnetworkvbox4.dll' [rcNtRedir=0xc0150008]
  1874. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ws2_32.dll'.
  1875. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qtcorevbox4.dll'.
  1876. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcr100.dll'.
  1877. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtNetworkVBox4.dll)WinVerifyTrust
  1878. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtNetworkVBox4.dll
  1879. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtguivbox4.dll'...
  1880. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtguivbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtguivbox4.dll' [rcNtRedir=0xc0150008]
  1881. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1882. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'comdlg32.dll'.
  1883. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
  1884. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  1885. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  1886. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1887. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ole32.dll'.
  1888. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1889. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'advapi32.dll'.
  1890. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'shell32.dll'.
  1891. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'qtcorevbox4.dll'.
  1892. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'msvcp100.dll'.
  1893. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'msvcr100.dll'.
  1894. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll)WinVerifyTrust
  1895. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll
  1896. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtcorevbox4.dll'...
  1897. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtcorevbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtcorevbox4.dll' [rcNtRedir=0xc0150008]
  1898. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1899. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'ole32.dll'.
  1900. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1901. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
  1902. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1903. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1904. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll)WinVerifyTrust
  1905. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  1906. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1907. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1908. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1909. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1910. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1911. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1912. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1913. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1914. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1915. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1916. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1917. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004b8 pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1918. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1919. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1920. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=608AC397FCC42B9FBAE25CB8C25EAF4C19AA384D
  1921. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
  1922. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1923. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1924. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1925. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1926. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
  1927. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
  1928. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1929. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll)WinVerifyTrust
  1930. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1931. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1932. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1933. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  1934. 14f8.8f8: Error (rc=0):
  1935. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=2 \Device\HarddiskVolume2\Windows\System32\user32.dll
  1936. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
  1937. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
  1938. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004a0 pwszName=\Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1939. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1940. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1941. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
  1942. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ddraw.dll'
  1943. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1944. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1945. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1946. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
  1947. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1948. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  1949. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
  1950. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ddraw.dll)WinVerifyTrust
  1951. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1952. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  1953. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  1954. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004bc pwszName=\Device\HarddiskVolume2\Windows\System32\glu32.dll
  1955. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  1956. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  1957. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60E45AB914E06A11F44EA76C6EF750AF892F9EA2
  1958. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\glu32.dll'
  1959. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1960. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1961. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1962. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1963. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\glu32.dll)WinVerifyTrust
  1964. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
  1965. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1966. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1967. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1968. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1969. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1970. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1971. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1972. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1973. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1974. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1975. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1976. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1977. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1978. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1979. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1980. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1981. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1982. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1983. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1984. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1985. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1986. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1987. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1988. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1989. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1990. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1991. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  1992. 14f8.8f8: Error (rc=0):
  1993. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=3 \Device\HarddiskVolume2\Windows\System32\user32.dll
  1994. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1995. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1996. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1997. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1998. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1999. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2000. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtcorevbox4.dll'...
  2001. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtcorevbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtcorevbox4.dll' [rcNtRedir=0xc0150008]
  2002. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  2003. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2004. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2005. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2006. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2007. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2008. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2009. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2010. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2011. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2012. 14f8.8f8: Error (rc=0):
  2013. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=4 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2014. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2015. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2016. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2017. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  2018. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  2019. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004d8 pwszName=\Device\HarddiskVolume2\Windows\System32\winspool.drv
  2020. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2021. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2022. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C89A2ED7B99A056D78CA6BAC9CCAB8B1FF119A14
  2023. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\winspool.drv'
  2024. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2025. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2026. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  2027. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2028. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winspool.drv)WinVerifyTrust
  2029. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2030. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2031. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2032. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2033. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2034. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2035. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2036. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2037. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2038. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2039. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  2040. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  2041. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2042. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2043. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2044. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2045. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2046. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2047. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2048. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtcorevbox4.dll'...
  2049. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtcorevbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtcorevbox4.dll' [rcNtRedir=0xc0150008]
  2050. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  2051. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2052. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2053. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  2054. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2055. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2056. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2057. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtcorevbox4.dll'...
  2058. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtcorevbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtcorevbox4.dll' [rcNtRedir=0xc0150008]
  2059. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  2060. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qtguivbox4.dll'...
  2061. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qtguivbox4.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qtguivbox4.dll' [rcNtRedir=0xc0150008]
  2062. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll
  2063. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2064. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2065. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2066. 14f8.8f8: Error (rc=0):
  2067. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=5 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2068. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2069. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2070. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2071. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2072. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2073. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2074. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2075. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2076. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2077. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2078. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2079. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2080. 14f8.8f8: Error (rc=0):
  2081. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=6 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2082. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2083. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2084. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2085. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2086. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2087. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2088. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2089. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2090. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2091. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2092. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2093. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2094. 14f8.8f8: Error (rc=0):
  2095. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=7 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2096. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2097. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2098. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2099. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2100. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2101. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2102. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2103. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2104. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2105. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2106. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2107. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2108. 14f8.8f8: Error (rc=0):
  2109. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=8 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2110. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2111. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2112. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2113. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2114. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2115. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2116. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2117. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2118. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2119. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2120. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2121. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2122. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  2123. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  2124. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004e8 pwszName=\Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2125. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2126. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2127. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5A2FB6B10717AFC03CD9FE6E8F1337A8EA94BF9B
  2128. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2864058~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
  2129. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2130. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2131. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2132. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2133. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll)WinVerifyTrust
  2134. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2135. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2136. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2137. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2138. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2139. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2140. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2141. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2142. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2143. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2144. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2145. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2146. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2147. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2148. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2149. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2150. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2151. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2152. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2153. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2154. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2155. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2156. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2157. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2158. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2159. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2160. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2161. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2162. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2163. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2164. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2165. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2166. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2167. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2168. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2169. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2170. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2171. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2172. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2173. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2174. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2175. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2176. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2177. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2178. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2179. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2180. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  2181. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  2182. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004c8 pwszName=\Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2183. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2184. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2185. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B79EE7B5AD74EF51A849809202E043183A2C727E
  2186. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
  2187. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2188. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2189. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2190. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2191. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll)WinVerifyTrust
  2192. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2193. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2194. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2195. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004f0 pwszName=\Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2196. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2197. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2198. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1499C4FEA6E143F9BEC35B4FFA098917D3A6EBF2
  2199. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  2200. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2201. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'cfgmgr32.dll'.
  2202. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcrt.dll'.
  2203. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
  2204. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  2205. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  2206. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  2207. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'devobj.dll'.
  2208. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll)WinVerifyTrust
  2209. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2210. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2211. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2212. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2213. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
  2214. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
  2215. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004e0 pwszName=\Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2216. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2217. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2218. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F097BF0B081F54722F0A01EF1CC13AECA64B12F0
  2219. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2847311~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume2\Windows\System32\dciman32.dll'
  2220. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2221. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2222. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  2223. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2224. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dciman32.dll)WinVerifyTrust
  2225. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2226. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2227. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2228. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2229. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2230. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2231. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2232. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2233. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2234. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2235. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2236. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2237. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2238. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2239. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2240. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2241. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  2242. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  2243. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004c0 pwszName=\Device\HarddiskVolume2\Windows\System32\devobj.dll
  2244. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2245. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2246. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B410A095222E69F0ECE7D66E4AC27A7125D2EB5A
  2247. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  2248. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2249. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2250. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'cfgmgr32.dll'.
  2251. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\devobj.dll)WinVerifyTrust
  2252. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
  2253. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2254. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2255. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2256. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2257. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2258. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2259. 14f8.8f8: Error (rc=0):
  2260. 14f8.8f8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=16 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2261. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2262. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2263. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2264. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2265. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2266. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2267. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2268. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2269. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2270. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  2271. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  2272. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004cc pwszName=\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2273. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2274. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2275. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8F731777EFC4BC982C1E1467FBF29A74CC14D93A
  2276. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  2277. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2278. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2279. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
  2280. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  2281. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll)WinVerifyTrust
  2282. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2283. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2284. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2285. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2286. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2287. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2288. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2289. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2290. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2291. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2292. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2293. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2294. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2295. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2296. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2297. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2298. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2299. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2300. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  2301. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  2302. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2303. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2304. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2305. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2306. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VirtualBox.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2307. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2308. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fed5b70000 LB 0x00872000 A:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  2309. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2310. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2311. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fed9de0000 LB 0x0011d000 A:\Windows\system32\OPENGL32.dll [fFlags=0x0]
  2312. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2313. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2314. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fedcf30000 LB 0x0002d000 A:\Windows\system32\GLU32.dll [fFlags=0x0]
  2315. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2316. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2317. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fee0a90000 LB 0x000f1000 A:\Windows\system32\DDRAW.dll [fFlags=0x0]
  2318. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2319. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2320. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefb330000 LB 0x00008000 A:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
  2321. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2322. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefeb10000 LB 0x001d7000 A:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
  2323. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2324. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefdbd0000 LB 0x00036000 A:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  2325. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2326. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff680000 LB 0x000d7000 A:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  2327. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2328. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefefe0000 LB 0x00203000 A:\Windows\system32\ole32.dll [fFlags=0x0]
  2329. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2330. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefdc30000 LB 0x0001a000 A:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  2331. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
  2332. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2333. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefb5f0000 LB 0x00018000 A:\Windows\system32\dwmapi.dll [fFlags=0x0]
  2334. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2335. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  2336. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000056850000 LB 0x002de000 A:\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll [fFlags=0x0]
  2337. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtCoreVBox4.dll
  2338. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll
  2339. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000055ee0000 LB 0x00969000 A:\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll [fFlags=0x0]
  2340. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtGuiVBox4.dll
  2341. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feff540000 LB 0x00097000 A:\Windows\system32\COMDLG32.dll [fFlags=0x0]
  2342. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2343. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2344. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2345. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2346. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll)
  2347. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll
  2348. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fef98c0000 LB 0x000a0000 A:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\COMCTL32.dll [fFlags=0x0]
  2349. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll [avoiding WinVerifyTrust]
  2350. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefdc50000 LB 0x00d88000 A:\Windows\system32\SHELL32.dll [fFlags=0x0]
  2351. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2352. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2353. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefafe0000 LB 0x0003b000 A:\Windows\system32\WINMM.dll [fFlags=0x0]
  2354. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2355. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2356. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fef9840000 LB 0x00071000 A:\Windows\system32\WINSPOOL.DRV [fFlags=0x0]
  2357. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2358. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtNetworkVBox4.dll
  2359. 14f8.8f8: supR3HardenedDllNotificationCallback: load 0000000058d40000 LB 0x00105000 A:\Program Files\Oracle\VirtualBox\QtNetworkVBox4.dll [fFlags=0x0]
  2360. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtNetworkVBox4.dll
  2361. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtOpenGLVBox4.dll
  2362. 14f8.8f8: supR3HardenedDllNotificationCallback: load 00000000588b0000 LB 0x000dc000 A:\Program Files\Oracle\VirtualBox\QtOpenGLVBox4.dll [fFlags=0x0]
  2363. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\QtOpenGLVBox4.dll
  2364. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000050c pwszName=\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll
  2365. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2366. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2367. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5A2FB6B10717AFC03CD9FE6E8F1337A8EA94BF9B
  2368. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2864058~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll'
  2369. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2370. 14f8.8f8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\comctl32.dll'
  2371. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'imm32.dll' -> 'A:\Windows\system32\imm32.dll' [rcNt=0xc0150008]
  2372. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2373. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2374. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2375. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2376. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2377. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2378. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2379. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2380. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2381. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\imm32.dll *pfFlags=0x0 pwszSearchPath=0000000000998800:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2382. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff1f0000 'A:\Windows\system32\imm32.dll'
  2383. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed5b70000 'A:\Program Files\Oracle\VirtualBox\VirtualBox.dll'
  2384. 14f8.8f8: SUPR3HardenedMain: Calling TrustedMain (000007fed5b71ca0)...
  2385. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2386. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\winmm.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2387. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefafe0000 'A:\Windows\system32\winmm.dll'
  2388. 14f8.8f8: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll: Owner is administrators group.
  2389. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000005a8 pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2390. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2391. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2392. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=936D45CC7026757A151F62882B557DD75D5FCB21
  2393. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
  2394. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2395. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2396. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2397. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  2398. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll)WinVerifyTrust
  2399. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2400. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2401. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2402. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2403. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2404. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2405. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2406. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2407. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2408. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=0000000000f74ff0:A:\Windows\system32;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2409. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2410. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefbf50000 LB 0x00056000 A:\Windows\system32\uxtheme.dll [fFlags=0x0]
  2411. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2412. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2413. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2414. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=0000000000f74ff0:A:\Windows\system32;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2415. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2416. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2417. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=0000000000f75c50:A:\Windows\system32;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2418. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2419. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2420. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=0000000000f75c50:A:\Windows\system32;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2421. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2422. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'dwmapi.dll' -> 'A:\Windows\system32\dwmapi.dll' [rcNt=0xc0150008]
  2423. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2424. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\dwmapi.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2425. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb5f0000 'A:\Windows\system32\dwmapi.dll'
  2426. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CRYPTBASE.dll' -> 'A:\Windows\system32\CRYPTBASE.dll' [rcNt=0xc0150008]
  2427. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2428. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPTBASE.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2429. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd730000 'A:\Windows\system32\CRYPTBASE.dll'
  2430. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2431. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\shell32.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2432. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdc50000 'A:\Windows\system32\shell32.dll'
  2433. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  2434. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\kernel32.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2435. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077960000 'A:\Windows\system32\kernel32.dll'
  2436. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2437. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2438. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2439. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2440. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2441. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2442. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: error opening 'A:\Windows\system32\wintab32.dll': 0 (NtPath=\??\A:\Windows\system32\wintab32.dll)
  2443. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\wintab32.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2444. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000135 'A:\Windows\system32\wintab32.dll'
  2445. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2446. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\uxtheme.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2447. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbf50000 'A:\Windows\system32\uxtheme.dll'
  2448. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2449. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\advapi32.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2450. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\advapi32.dll'
  2451. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll
  2452. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\userenv.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2453. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdbb0000 'A:\Windows\system32\userenv.dll'
  2454. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  2455. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\kernel32.dll *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2456. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000077960000 'A:\Windows\system32\kernel32.dll'
  2457. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CLBCatQ.DLL' -> 'A:\Windows\system32\CLBCatQ.DLL' [rcNt=0xc0150008]
  2458. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000005fc pwszName=\Device\HarddiskVolume2\Windows\System32\clbcatq.dll
  2459. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2460. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2461. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B01469787CE9D8C6FEE98FB207652B88B8494526
  2462. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\clbcatq.dll'
  2463. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2464. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2465. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'ole32.dll'.
  2466. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2467. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  2468. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2469. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
  2470. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\clbcatq.dll)WinVerifyTrust
  2471. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\clbcatq.dll
  2472. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2473. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2474. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2475. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2476. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2477. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2478. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2479. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2480. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2481. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2482. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2483. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2484. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2485. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2486. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2487. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2488. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2489. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CLBCatQ.DLL *pfFlags=0x0 pwszSearchPath=00000000009984a0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2490. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\clbcatq.dll
  2491. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007feffa80000 LB 0x00099000 A:\Windows\system32\CLBCatQ.DLL [fFlags=0x0]
  2492. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\clbcatq.dll
  2493. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feffa80000 'A:\Windows\system32\CLBCatQ.DLL'
  2494. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ADVAPI32.dll' -> 'A:\Windows\system32\ADVAPI32.dll' [rcNt=0xc0150008]
  2495. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2496. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ADVAPI32.dll *pfFlags=0x0 pwszSearchPath=0000000000998a40:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2497. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\ADVAPI32.dll'
  2498. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'CRYPTSP.dll' -> 'A:\Windows\system32\CRYPTSP.dll' [rcNt=0xc0150008]
  2499. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  2500. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\CRYPTSP.dll *pfFlags=0x0 pwszSearchPath=0000000000998b60:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2501. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'A:\Windows\system32\CRYPTSP.dll'
  2502. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'RpcRtRemote.dll' -> 'A:\Windows\system32\RpcRtRemote.dll' [rcNt=0xc0150008]
  2503. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000061c pwszName=\Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll
  2504. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2505. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2506. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DFC4A7C7E103D324218E6EF5D219B953746D6EC1
  2507. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll'
  2508. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2509. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  2510. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll)WinVerifyTrust
  2511. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll
  2512. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2513. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2514. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  2515. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\RpcRtRemote.dll *pfFlags=0x0 pwszSearchPath=0000000000998b60:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2516. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll
  2517. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd7e0000 LB 0x00014000 A:\Windows\system32\RpcRtRemote.dll [fFlags=0x0]
  2518. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll
  2519. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd7e0000 'A:\Windows\system32\RpcRtRemote.dll'
  2520. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2521. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\oleaut32.dll *pfFlags=0x0 pwszSearchPath=0000000000f75c50:A:\Windows\system32;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2522. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff680000 'A:\Windows\system32\oleaut32.dll'
  2523. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'SXS.DLL' -> 'A:\Windows\system32\SXS.DLL' [rcNt=0xc0150008]
  2524. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000638 pwszName=\Device\HarddiskVolume2\Windows\System32\sxs.dll
  2525. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2526. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2527. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FCAC019C19F878C2B628662A84ECE75A01818BC9
  2528. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\sxs.dll'
  2529. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2530. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sxs.dll)WinVerifyTrust
  2531. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sxs.dll
  2532. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\SXS.DLL *pfFlags=0x0 pwszSearchPath=0000000000998bf0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2533. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sxs.dll
  2534. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd740000 LB 0x00091000 A:\Windows\system32\SXS.DLL [fFlags=0x0]
  2535. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sxs.dll
  2536. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd740000 'A:\Windows\system32\SXS.DLL'
  2537. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ADVAPI32.dll' -> 'A:\Windows\system32\ADVAPI32.dll' [rcNt=0xc0150008]
  2538. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2539. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ADVAPI32.dll *pfFlags=0x0 pwszSearchPath=0000000000998bf0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2540. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\ADVAPI32.dll'
  2541. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'OLEAUT32' -> 'A:\Windows\system32\OLEAUT32.dll' [rcNt=0xc0150008]
  2542. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2543. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\OLEAUT32.dll *pfFlags=0x0 pwszSearchPath=0000000000999220:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2544. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff680000 'A:\Windows\system32\OLEAUT32.dll'
  2545. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: error opening 'A:\Windows\system32\wintab32.dll': 0 (NtPath=\??\A:\Windows\system32\wintab32.dll)
  2546. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\wintab32.dll *pfFlags=0x0 pwszSearchPath=0000000000999100:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2547. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000135 'A:\Windows\system32\wintab32.dll'
  2548. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2549. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\gdi32.dll *pfFlags=0x0 pwszSearchPath=0000000000999100:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2550. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefef70000 'A:\Windows\system32\gdi32.dll'
  2551. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2552. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2553. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2554. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  2555. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  2556. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ole32.dll'.
  2557. 14f8.2c04: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
  2558. 14f8.2c04: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxC.dll)WinVerifyTrust
  2559. 14f8.2c04: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxC.dll
  2560. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2561. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2562. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2563. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2564. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2565. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2566. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2567. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2568. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  2569. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2570. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2571. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2572. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2573. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2574. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  2575. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2576. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2577. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2578. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2579. 14f8.2c04: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2580. 14f8.2c04: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2581. 14f8.2c04: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox\VBoxC.dll *pfFlags=0x0 pwszSearchPath=00000000009d2230:A:\Program Files\Oracle\VirtualBox;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2582. 14f8.2c04: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxC.dll
  2583. 14f8.2c04: supR3HardenedDllNotificationCallback: load 000007fed6b00000 LB 0x004e7000 A:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  2584. 14f8.2c04: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxC.dll
  2585. 14f8.2c04: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fed6b00000 'A:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  2586. 14f8.1aac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2587. 14f8.1aac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2588. 14f8.1aac: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMain.dll)WinVerifyTrust
  2589. 14f8.1aac: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMain.dll
  2590. 14f8.1aac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2591. 14f8.1aac: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2592. 14f8.1aac: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  2593. 14f8.1aac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2594. 14f8.1aac: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2595. 14f8.1aac: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2596. 14f8.1aac: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\Oracle\VirtualBox/ExtensionPacks/Oracle_VM_VirtualBox_Extension_Pack/win.amd64/VBoxPuelMain.DLL *pfFlags=0x0 pwszSearchPath=00000000031a8590:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2597. 14f8.1aac: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMain.dll
  2598. 14f8.1aac: supR3HardenedDllNotificationCallback: load 000007fedcf20000 LB 0x0000a000 A:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMain.DLL [fFlags=0x0]
  2599. 14f8.1aac: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMain.dll
  2600. 14f8.1aac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fedcf20000 'A:\Program Files\Oracle\VirtualBox/ExtensionPacks/Oracle_VM_VirtualBox_Extension_Pack/win.amd64/VBoxPuelMain.DLL'
  2601. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2602. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\shell32.dll *pfFlags=0x0 pwszSearchPath=0000000000998da0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2603. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdc50000 'A:\Windows\system32\shell32.dll'
  2604. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'ADVAPI32.dll' -> 'A:\Windows\system32\ADVAPI32.dll' [rcNt=0xc0150008]
  2605. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2606. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ADVAPI32.dll *pfFlags=0x0 pwszSearchPath=0000000000998da0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2607. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff760000 'A:\Windows\system32\ADVAPI32.dll'
  2608. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2609. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\ole32.dll *pfFlags=0x0 pwszSearchPath=0000000000998da0:A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2610. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefefe0000 'A:\Windows\system32\ole32.dll'
  2611. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  2612. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  2613. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shell32.dll'.
  2614. 14f8.8f8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
  2615. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\UltraMon\RTSUltraMonHook.dll)WinVerifyTrust
  2616. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\UltraMon\RTSUltraMonHook.dll
  2617. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2618. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2619. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2620. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2621. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2622. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2623. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2624. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2625. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2626. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2627. 14f8.8f8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2628. 14f8.8f8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2629. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Program Files\UltraMon\RTSUltraMonHook.dll *pfFlags=0x0 pwszSearchPath=0000000003085b60:A:\Program Files\UltraMon;A:\Program Files\Oracle\VirtualBox;A:\Windows\system32 [calling]
  2630. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\UltraMon\RTSUltraMonHook.dll
  2631. 14f8.8f8: supR3HardenedDllNotificationCallback: load 00000000694d0000 LB 0x00045000 A:\Program Files\UltraMon\RTSUltraMonHook.dll [fFlags=0x0]
  2632. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\UltraMon\RTSUltraMonHook.dll
  2633. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00000000694d0000 'A:\Program Files\UltraMon\RTSUltraMonHook.dll'
  2634. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: 'USER32.dll' -> 'A:\Windows\system32\USER32.dll' [rcNt=0xc0150008]
  2635. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000009c4 pwszName=\Device\HarddiskVolume2\Windows\System32\apphelp.dll
  2636. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000003084350
  2637. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000003084350
  2638. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82846C7DC170BBD7F68FE9966A8D339A60BCFF16
  2639. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='A:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\apphelp.dll'
  2640. 14f8.8f8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2641. 14f8.8f8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)WinVerifyTrust
  2642. 14f8.8f8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  2643. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: pName=A:\Windows\system32\apphelp.dll *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  2644. 14f8.8f8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  2645. 14f8.8f8: supR3HardenedDllNotificationCallback: load 000007fefd6d0000 LB 0x00057000 A:\Windows\system32\apphelp.dll [fFlags=0x0]
  2646. 14f8.8f8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  2647. 14f8.8f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6d0000 'A:\Windows\system32\apphelp.dll'
  2648. 1a10.2cc0: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0xc000041d (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 4348 ms, the end);
  2649. 172c.23cc: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc000041d (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 5011 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!