API tools faq
paste
Advertisement
Guest User

Untitled

a guest
May 20th, 2018
220
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 206.31 KB | None | 0 0
raw download clone embed print report
  1. 1030.1034: Log file opened: 5.2.12r122591 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110
  2. 1030.1034: \SystemRoot\System32\ntdll.dll:
  3. 1030.1034: CreationTime: 2015-11-28T20:29:01.066131500Z
  4. 1030.1034: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  5. 1030.1034: ChangeTime: 2017-03-11T21:28:06.222347200Z
  6. 1030.1034: FileAttributes: 0x20
  7. 1030.1034: Size: 0x1a67c0
  8. 1030.1034: NT Headers: 0xe0
  9. 1030.1034: Timestamp: 0x56259295
  10. 1030.1034: Machine: 0x8664 - amd64
  11. 1030.1034: Timestamp: 0x56259295
  12. 1030.1034: Image Version: 6.1
  13. 1030.1034: SizeOfImage: 0x1a9000 (1740800)
  14. 1030.1034: Resource Dir: 0x14d000 LB 0x5a028
  15. 1030.1034: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 1030.1034: [Raw version resource data: 0x14d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 1030.1034: ProductName: Microsoft® Windows® Operating System
  18. 1030.1034: ProductVersion: 6.1.7601.19045
  19. 1030.1034: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  20. 1030.1034: FileDescription: NT Layer DLL
  21. 1030.1034: \SystemRoot\System32\kernel32.dll:
  22. 1030.1034: CreationTime: 2015-11-28T20:29:01.066131500Z
  23. 1030.1034: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  24. 1030.1034: ChangeTime: 2017-03-11T21:27:38.759018400Z
  25. 1030.1034: FileAttributes: 0x20
  26. 1030.1034: Size: 0x11c600
  27. 1030.1034: NT Headers: 0xe8
  28. 1030.1034: Timestamp: 0x56259270
  29. 1030.1034: Machine: 0x8664 - amd64
  30. 1030.1034: Timestamp: 0x56259270
  31. 1030.1034: Image Version: 6.1
  32. 1030.1034: SizeOfImage: 0x120000 (1179648)
  33. 1030.1034: Resource Dir: 0x117000 LB 0x528
  34. 1030.1034: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 1030.1034: [Raw version resource data: 0x1170b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 1030.1034: ProductName: Microsoft® Windows® Operating System
  37. 1030.1034: ProductVersion: 6.1.7601.19045
  38. 1030.1034: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  39. 1030.1034: FileDescription: Windows NT BASE API Client DLL
  40. 1030.1034: \SystemRoot\System32\KernelBase.dll:
  41. 1030.1034: CreationTime: 2015-11-28T20:29:01.081731500Z
  42. 1030.1034: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  43. 1030.1034: ChangeTime: 2017-03-11T21:27:38.759018400Z
  44. 1030.1034: FileAttributes: 0x20
  45. 1030.1034: Size: 0x67c00
  46. 1030.1034: NT Headers: 0xe8
  47. 1030.1034: Timestamp: 0x56259271
  48. 1030.1034: Machine: 0x8664 - amd64
  49. 1030.1034: Timestamp: 0x56259271
  50. 1030.1034: Image Version: 6.1
  51. 1030.1034: SizeOfImage: 0x6c000 (442368)
  52. 1030.1034: Resource Dir: 0x6a000 LB 0x530
  53. 1030.1034: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 1030.1034: [Raw version resource data: 0x6a0b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  55. 1030.1034: ProductName: Microsoft® Windows® Operating System
  56. 1030.1034: ProductVersion: 6.1.7601.19045
  57. 1030.1034: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  58. 1030.1034: FileDescription: Windows NT BASE API Client DLL
  59. 1030.1034: \SystemRoot\System32\apisetschema.dll:
  60. 1030.1034: CreationTime: 2015-11-28T20:29:01.066131500Z
  61. 1030.1034: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  62. 1030.1034: ChangeTime: 2017-03-11T21:27:08.829462700Z
  63. 1030.1034: FileAttributes: 0x20
  64. 1030.1034: Size: 0x1a00
  65. 1030.1034: NT Headers: 0xc0
  66. 1030.1034: Timestamp: 0x562590e2
  67. 1030.1034: Machine: 0x8664 - amd64
  68. 1030.1034: Timestamp: 0x562590e2
  69. 1030.1034: Image Version: 6.1
  70. 1030.1034: SizeOfImage: 0x50000 (327680)
  71. 1030.1034: Resource Dir: 0x30000 LB 0x3f8
  72. 1030.1034: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 1030.1034: [Raw version resource data: 0x30060 LB 0x398, codepage 0x0 (reserved 0x0)]
  74. 1030.1034: ProductName: Microsoft® Windows® Operating System
  75. 1030.1034: ProductVersion: 6.1.7601.19045
  76. 1030.1034: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  77. 1030.1034: FileDescription: ApiSet Schema DLL
  78. 1030.1034: supR3HardenedWinFindAdversaries: 0x0
  79. 1030.1034: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  80. 1030.1034: Calling main()
  81. 1030.1034: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  82. 1030.1034: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  83. 1030.1034: SUPR3HardenedMain: Respawn #1
  84. 1030.1034: System32: \Device\HarddiskVolume3\Windows\System32
  85. 1030.1034: WinSxS: \Device\HarddiskVolume3\Windows\winsxs
  86. 1030.1034: KnownDllPath: C:\Windows\system32
  87. 1030.1034: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  88. 1030.1034: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  89. 1030.1034: supR3HardNtEnableThreadCreation:
  90. 1030.1034: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007730b630 pvNtTerminateThread=000000007732dee0
  91. 1030.1034: supR3HardenedWinDoReSpawn(1): New child 1038.103c [kernel32].
  92. 1030.1034: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdb000 cbPeb=0x380
  93. 1030.1034: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00000000772e0000 uNtDllChildAddr=00000000772e0000
  94. 1030.1034: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007730b630
  95. 1030.1034: supR3HardenedWinSetupChildInit: Start child.
  96. 1030.1034: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 5 ms.
  97. 1030.1034: supR3HardNtChildPurify: Startup delay kludge #1/0: 262 ms, 21 sleeps
  98. 1030.1034: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  99. 1030.1034: *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  100. 1030.1034: *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  101. 1030.1034: *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  102. 1030.1034: 0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  103. 1030.1034: *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  104. 1030.1034: 0000000000041000-00000000001cffff 0x0001/0x0000 0x0000000
  105. 1030.1034: *00000000001d0000-00000000002cbfff 0x0000/0x0004 0x0020000
  106. 1030.1034: 00000000002cc000-00000000002cdfff 0x0104/0x0004 0x0020000
  107. 1030.1034: 00000000002ce000-00000000002cffff 0x0004/0x0004 0x0020000
  108. 1030.1034: 00000000002d0000-00000000772dffff 0x0001/0x0000 0x0000000
  109. 1030.1034: *00000000772e0000-00000000772e0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  110. 1030.1034: 00000000772e1000-00000000773defff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  111. 1030.1034: 00000000773df000-000000007740dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  112. 1030.1034: 000000007740e000-0000000077415fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  113. 1030.1034: 0000000077416000-0000000077416fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  114. 1030.1034: 0000000077417000-0000000077419fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  115. 1030.1034: 000000007741a000-0000000077488fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  116. 1030.1034: 0000000077489000-000000007efdffff 0x0001/0x0000 0x0000000
  117. 1030.1034: *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  118. 1030.1034: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  119. 1030.1034: 000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  120. 1030.1034: 000000007fff0000-000000013f1bffff 0x0001/0x0000 0x0000000
  121. 1030.1034: *000000013f1c0000-000000013f1c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  122. 1030.1034: 000000013f1c1000-000000013f231fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  123. 1030.1034: 000000013f232000-000000013f232fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  124. 1030.1034: 000000013f233000-000000013f278fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  125. 1030.1034: 000000013f279000-000000013f279fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  126. 1030.1034: 000000013f27a000-000000013f27afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  127. 1030.1034: 000000013f27b000-000000013f27ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  128. 1030.1034: 000000013f280000-000000013f280fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  129. 1030.1034: 000000013f281000-000000013f281fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  130. 1030.1034: 000000013f282000-000000013f285fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  131. 1030.1034: 000000013f286000-000000013f2cdfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  132. 1030.1034: 000000013f2ce000-000007feff5fffff 0x0001/0x0000 0x0000000
  133. 1030.1034: *000007feff600000-000007feff600fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\apisetschema.dll
  134. 1030.1034: 000007feff601000-000007fffffaffff 0x0001/0x0000 0x0000000
  135. 1030.1034: *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  136. 1030.1034: 000007fffffd3000-000007fffffdafff 0x0001/0x0000 0x0000000
  137. 1030.1034: *000007fffffdb000-000007fffffdbfff 0x0004/0x0004 0x0020000
  138. 1030.1034: 000007fffffdc000-000007fffffddfff 0x0001/0x0000 0x0000000
  139. 1030.1034: *000007fffffde000-000007fffffdffff 0x0004/0x0004 0x0020000
  140. 1030.1034: *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  141. 1030.1034: apisetschema.dll: timestamp 0x562590e2 (rc=VINF_SUCCESS)
  142. 1030.1034: VirtualBox.exe: timestamp 0x5af2c2c3 (rc=VINF_SUCCESS)
  143. 1030.1034: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  144. 1030.1034: \Device\HarddiskVolume3\Windows\System32\apisetschema.dll: Owner is administrators group.
  145. 1030.1034: '\Device\HarddiskVolume3\Windows\System32\apisetschema.dll' has no imports
  146. 1030.1034: \Device\HarddiskVolume3\Windows\System32\ntdll.dll: Owner is administrators group.
  147. 1030.1034: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  148. 1030.1034: supR3HardNtChildPurify: Done after 278 ms and 0 fixes (loop #0).
  149. 1038.103c: Log file opened: 5.2.12r122591 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  150. 1038.103c: supR3HardenedVmProcessInit: uNtDllAddr=00000000772e0000 g_uNtVerCombined=0x611db100
  151. 1038.103c: ntdll.dll: timestamp 0x56259295 (rc=VINF_SUCCESS)
  152. 1038.103c: New simple heap: #1 00000000002d0000 LB 0x400000 (for 1740800 allocation)
  153. 1030.1034: supR3HardNtEnableThreadCreation:
  154. 1038.103c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  155. 1038.103c: System32: \Device\HarddiskVolume3\Windows\System32
  156. 1038.103c: WinSxS: \Device\HarddiskVolume3\Windows\winsxs
  157. 1038.103c: KnownDllPath: C:\Windows\system32
  158. 1038.103c: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  159. 1038.103c: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  160. 1038.103c: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  161. 1038.103c: Registered Dll notification callback with NTDLL.
  162. 1038.103c: \Device\HarddiskVolume3\Windows\System32\kernel32.dll: Owner is administrators group.
  163. 1038.103c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  164. 1038.103c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  165. 1038.103c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  166. 1038.103c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  167. 1038.103c: supR3HardenedDllNotificationCallback: load 00000000770b0000 LB 0x00120000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  168. 1038.103c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  169. 1038.103c: supR3HardenedDllNotificationCallback: load 000007fefcd50000 LB 0x0006c000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  170. 1038.103c: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll: Owner is administrators group.
  171. 1038.103c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  172. 1038.103c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  173. 1038.103c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00000000770b0000 'C:\Windows\system32\kernel32.dll'
  174. 1038.103c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007730b630 pvNtTerminateThread=000000007732dee0
  175. 1030.1034: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 16 ms.
  176. 1038.103c: \SystemRoot\System32\ntdll.dll:
  177. 1038.103c: CreationTime: 2015-11-28T20:29:01.066131500Z
  178. 1038.103c: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  179. 1038.103c: ChangeTime: 2017-03-11T21:28:06.222347200Z
  180. 1038.103c: FileAttributes: 0x20
  181. 1038.103c: Size: 0x1a67c0
  182. 1038.103c: NT Headers: 0xe0
  183. 1038.103c: Timestamp: 0x56259295
  184. 1038.103c: Machine: 0x8664 - amd64
  185. 1038.103c: Timestamp: 0x56259295
  186. 1038.103c: Image Version: 6.1
  187. 1038.103c: SizeOfImage: 0x1a9000 (1740800)
  188. 1038.103c: Resource Dir: 0x14d000 LB 0x5a028
  189. 1038.103c: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  190. 1038.103c: [Raw version resource data: 0x14d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  191. 1038.103c: ProductName: Microsoft® Windows® Operating System
  192. 1038.103c: ProductVersion: 6.1.7601.19045
  193. 1038.103c: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  194. 1038.103c: FileDescription: NT Layer DLL
  195. 1038.103c: \SystemRoot\System32\kernel32.dll:
  196. 1038.103c: CreationTime: 2015-11-28T20:29:01.066131500Z
  197. 1038.103c: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  198. 1038.103c: ChangeTime: 2017-03-11T21:27:38.759018400Z
  199. 1038.103c: FileAttributes: 0x20
  200. 1038.103c: Size: 0x11c600
  201. 1038.103c: NT Headers: 0xe8
  202. 1038.103c: Timestamp: 0x56259270
  203. 1038.103c: Machine: 0x8664 - amd64
  204. 1038.103c: Timestamp: 0x56259270
  205. 1038.103c: Image Version: 6.1
  206. 1038.103c: SizeOfImage: 0x120000 (1179648)
  207. 1038.103c: Resource Dir: 0x117000 LB 0x528
  208. 1038.103c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  209. 1038.103c: [Raw version resource data: 0x1170b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  210. 1038.103c: ProductName: Microsoft® Windows® Operating System
  211. 1038.103c: ProductVersion: 6.1.7601.19045
  212. 1038.103c: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  213. 1038.103c: FileDescription: Windows NT BASE API Client DLL
  214. 1038.103c: \SystemRoot\System32\KernelBase.dll:
  215. 1038.103c: CreationTime: 2015-11-28T20:29:01.081731500Z
  216. 1038.103c: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  217. 1038.103c: ChangeTime: 2017-03-11T21:27:38.759018400Z
  218. 1038.103c: FileAttributes: 0x20
  219. 1038.103c: Size: 0x67c00
  220. 1038.103c: NT Headers: 0xe8
  221. 1038.103c: Timestamp: 0x56259271
  222. 1038.103c: Machine: 0x8664 - amd64
  223. 1038.103c: Timestamp: 0x56259271
  224. 1038.103c: Image Version: 6.1
  225. 1038.103c: SizeOfImage: 0x6c000 (442368)
  226. 1038.103c: Resource Dir: 0x6a000 LB 0x530
  227. 1038.103c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  228. 1038.103c: [Raw version resource data: 0x6a0b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  229. 1038.103c: ProductName: Microsoft® Windows® Operating System
  230. 1038.103c: ProductVersion: 6.1.7601.19045
  231. 1038.103c: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  232. 1038.103c: FileDescription: Windows NT BASE API Client DLL
  233. 1038.103c: \SystemRoot\System32\apisetschema.dll:
  234. 1038.103c: CreationTime: 2015-11-28T20:29:01.066131500Z
  235. 1038.103c: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  236. 1038.103c: ChangeTime: 2017-03-11T21:27:08.829462700Z
  237. 1038.103c: FileAttributes: 0x20
  238. 1038.103c: Size: 0x1a00
  239. 1038.103c: NT Headers: 0xc0
  240. 1038.103c: Timestamp: 0x562590e2
  241. 1038.103c: Machine: 0x8664 - amd64
  242. 1038.103c: Timestamp: 0x562590e2
  243. 1038.103c: Image Version: 6.1
  244. 1038.103c: SizeOfImage: 0x50000 (327680)
  245. 1038.103c: Resource Dir: 0x30000 LB 0x3f8
  246. 1038.103c: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  247. 1038.103c: [Raw version resource data: 0x30060 LB 0x398, codepage 0x0 (reserved 0x0)]
  248. 1038.103c: ProductName: Microsoft® Windows® Operating System
  249. 1038.103c: ProductVersion: 6.1.7601.19045
  250. 1038.103c: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  251. 1038.103c: FileDescription: ApiSet Schema DLL
  252. 1038.103c: supR3HardenedWinFindAdversaries: 0x0
  253. 1038.103c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  254. 1038.103c: Calling main()
  255. 1038.103c: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  256. 1038.103c: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  257. 1038.103c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  258. 1038.103c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  259. 1038.103c: SUPR3HardenedMain: Respawn #2
  260. 1038.103c: supR3HardNtEnableThreadCreation:
  261. 1038.103c: \Device\HarddiskVolume3\Windows\System32\apphelp.dll: Owner is administrators group.
  262. 1038.103c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\apphelp.dll)
  263. 1038.103c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\apphelp.dll
  264. 1038.103c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  265. 1038.103c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  266. 1038.103c: supR3HardenedDllNotificationCallback: load 000007fefcb70000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
  267. 1038.103c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  268. 1038.103c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcb70000 'C:\Windows\system32\apphelp.dll'
  269. 1038.103c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007730b630 pvNtTerminateThread=000000007732dee0
  270. 1038.103c: supR3HardenedWinDoReSpawn(2): New child 1044.1048 [kernel32].
  271. 1038.103c: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380
  272. 1038.103c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00000000772e0000 uNtDllChildAddr=00000000772e0000
  273. 1038.103c: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007730b630
  274. 1038.103c: supR3HardenedWinSetupChildInit: Start child.
  275. 1038.103c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  276. 1038.103c: supR3HardNtChildPurify: Startup delay kludge #1/0: 265 ms, 17 sleeps
  277. 1038.103c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  278. 1038.103c: *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  279. 1038.103c: *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  280. 1038.103c: *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  281. 1038.103c: 0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  282. 1038.103c: *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  283. 1038.103c: 0000000000041000-000000000017ffff 0x0001/0x0000 0x0000000
  284. 1038.103c: *0000000000180000-000000000027bfff 0x0000/0x0004 0x0020000
  285. 1038.103c: 000000000027c000-000000000027dfff 0x0104/0x0004 0x0020000
  286. 1038.103c: 000000000027e000-000000000027ffff 0x0004/0x0004 0x0020000
  287. 1038.103c: 0000000000280000-00000000772dffff 0x0001/0x0000 0x0000000
  288. 1038.103c: *00000000772e0000-00000000772e0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  289. 1038.103c: 00000000772e1000-00000000773defff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  290. 1038.103c: 00000000773df000-000000007740dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  291. 1038.103c: 000000007740e000-0000000077415fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  292. 1038.103c: 0000000077416000-0000000077416fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  293. 1038.103c: 0000000077417000-0000000077419fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  294. 1038.103c: 000000007741a000-0000000077488fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  295. 1038.103c: 0000000077489000-000000007efdffff 0x0001/0x0000 0x0000000
  296. 1038.103c: *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  297. 1038.103c: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  298. 1038.103c: 000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  299. 1038.103c: 000000007fff0000-000000013f1bffff 0x0001/0x0000 0x0000000
  300. 1038.103c: *000000013f1c0000-000000013f1c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  301. 1038.103c: 000000013f1c1000-000000013f231fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  302. 1038.103c: 000000013f232000-000000013f232fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  303. 1038.103c: 000000013f233000-000000013f278fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  304. 1038.103c: 000000013f279000-000000013f279fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  305. 1038.103c: 000000013f27a000-000000013f27afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  306. 1038.103c: 000000013f27b000-000000013f27ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  307. 1038.103c: 000000013f280000-000000013f280fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  308. 1038.103c: 000000013f281000-000000013f281fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  309. 1038.103c: 000000013f282000-000000013f285fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  310. 1038.103c: 000000013f286000-000000013f2cdfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  311. 1038.103c: 000000013f2ce000-000007feff5fffff 0x0001/0x0000 0x0000000
  312. 1038.103c: *000007feff600000-000007feff600fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\apisetschema.dll
  313. 1038.103c: 000007feff601000-000007fffffaffff 0x0001/0x0000 0x0000000
  314. 1038.103c: *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  315. 1038.103c: 000007fffffd3000-000007fffffdcfff 0x0001/0x0000 0x0000000
  316. 1038.103c: *000007fffffdd000-000007fffffdefff 0x0004/0x0004 0x0020000
  317. 1038.103c: *000007fffffdf000-000007fffffdffff 0x0004/0x0004 0x0020000
  318. 1038.103c: *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  319. 1038.103c: apisetschema.dll: timestamp 0x562590e2 (rc=VINF_SUCCESS)
  320. 1038.103c: VirtualBox.exe: timestamp 0x5af2c2c3 (rc=VINF_SUCCESS)
  321. 1038.103c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  322. 1038.103c: \Device\HarddiskVolume3\Windows\System32\apisetschema.dll: Owner is administrators group.
  323. 1038.103c: '\Device\HarddiskVolume3\Windows\System32\apisetschema.dll' has no imports
  324. 1038.103c: \Device\HarddiskVolume3\Windows\System32\ntdll.dll: Owner is administrators group.
  325. 1038.103c: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  326. 1038.103c: supR3HardNtChildPurify: Done after 282 ms and 0 fixes (loop #0).
  327. 1044.1048: Log file opened: 5.2.12r122591 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  328. 1044.1048: supR3HardenedVmProcessInit: uNtDllAddr=00000000772e0000 g_uNtVerCombined=0x611db100
  329. 1044.1048: ntdll.dll: timestamp 0x56259295 (rc=VINF_SUCCESS)
  330. 1044.1048: New simple heap: #1 0000000000280000 LB 0x400000 (for 1740800 allocation)
  331. 1038.103c: supR3HardenedEarlyCompact: Removed heap 1 (0x000000002d0000 LB 0x400000)
  332. 1038.103c: supR3HardNtEnableThreadCreation:
  333. 1044.1048: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  334. 1044.1048: System32: \Device\HarddiskVolume3\Windows\System32
  335. 1044.1048: WinSxS: \Device\HarddiskVolume3\Windows\winsxs
  336. 1044.1048: KnownDllPath: C:\Windows\system32
  337. 1044.1048: supR3HardenedVmProcessInit: Opening vboxdrv...
  338. 1044.1048: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  339. 1044.1048: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  340. 1044.1048: Registered Dll notification callback with NTDLL.
  341. 1044.1048: \Device\HarddiskVolume3\Windows\System32\kernel32.dll: Owner is administrators group.
  342. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  343. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  344. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  345. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  346. 1044.1048: supR3HardenedDllNotificationCallback: load 00000000770b0000 LB 0x00120000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  347. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  348. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcd50000 LB 0x0006c000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  349. 1044.1048: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll: Owner is administrators group.
  350. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  351. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  352. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00000000770b0000 'C:\Windows\system32\kernel32.dll'
  353. 1044.1048: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007730b630 pvNtTerminateThread=000000007732dee0
  354. 1038.103c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 15 ms.
  355. 1044.1048: \SystemRoot\System32\ntdll.dll:
  356. 1044.1048: CreationTime: 2015-11-28T20:29:01.066131500Z
  357. 1044.1048: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  358. 1044.1048: ChangeTime: 2017-03-11T21:28:06.222347200Z
  359. 1044.1048: FileAttributes: 0x20
  360. 1044.1048: Size: 0x1a67c0
  361. 1044.1048: NT Headers: 0xe0
  362. 1044.1048: Timestamp: 0x56259295
  363. 1044.1048: Machine: 0x8664 - amd64
  364. 1044.1048: Timestamp: 0x56259295
  365. 1044.1048: Image Version: 6.1
  366. 1044.1048: SizeOfImage: 0x1a9000 (1740800)
  367. 1044.1048: Resource Dir: 0x14d000 LB 0x5a028
  368. 1044.1048: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  369. 1044.1048: [Raw version resource data: 0x14d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  370. 1044.1048: ProductName: Microsoft® Windows® Operating System
  371. 1044.1048: ProductVersion: 6.1.7601.19045
  372. 1044.1048: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  373. 1044.1048: FileDescription: NT Layer DLL
  374. 1044.1048: \SystemRoot\System32\kernel32.dll:
  375. 1044.1048: CreationTime: 2015-11-28T20:29:01.066131500Z
  376. 1044.1048: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  377. 1044.1048: ChangeTime: 2017-03-11T21:27:38.759018400Z
  378. 1044.1048: FileAttributes: 0x20
  379. 1044.1048: Size: 0x11c600
  380. 1044.1048: NT Headers: 0xe8
  381. 1044.1048: Timestamp: 0x56259270
  382. 1044.1048: Machine: 0x8664 - amd64
  383. 1044.1048: Timestamp: 0x56259270
  384. 1044.1048: Image Version: 6.1
  385. 1044.1048: SizeOfImage: 0x120000 (1179648)
  386. 1044.1048: Resource Dir: 0x117000 LB 0x528
  387. 1044.1048: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  388. 1044.1048: [Raw version resource data: 0x1170b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  389. 1044.1048: ProductName: Microsoft® Windows® Operating System
  390. 1044.1048: ProductVersion: 6.1.7601.19045
  391. 1044.1048: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  392. 1044.1048: FileDescription: Windows NT BASE API Client DLL
  393. 1044.1048: \SystemRoot\System32\KernelBase.dll:
  394. 1044.1048: CreationTime: 2015-11-28T20:29:01.081731500Z
  395. 1044.1048: LastWriteTime: 2015-11-28T20:29:01.081731500Z
  396. 1044.1048: ChangeTime: 2017-03-11T21:27:38.759018400Z
  397. 1044.1048: FileAttributes: 0x20
  398. 1044.1048: Size: 0x67c00
  399. 1044.1048: NT Headers: 0xe8
  400. 1044.1048: Timestamp: 0x56259271
  401. 1044.1048: Machine: 0x8664 - amd64
  402. 1044.1048: Timestamp: 0x56259271
  403. 1044.1048: Image Version: 6.1
  404. 1044.1048: SizeOfImage: 0x6c000 (442368)
  405. 1044.1048: Resource Dir: 0x6a000 LB 0x530
  406. 1044.1048: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  407. 1044.1048: [Raw version resource data: 0x6a0b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  408. 1044.1048: ProductName: Microsoft® Windows® Operating System
  409. 1044.1048: ProductVersion: 6.1.7601.19045
  410. 1044.1048: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  411. 1044.1048: FileDescription: Windows NT BASE API Client DLL
  412. 1044.1048: \SystemRoot\System32\apisetschema.dll:
  413. 1044.1048: CreationTime: 2015-11-28T20:29:01.066131500Z
  414. 1044.1048: LastWriteTime: 2015-11-28T20:29:01.066131500Z
  415. 1044.1048: ChangeTime: 2017-03-11T21:27:08.829462700Z
  416. 1044.1048: FileAttributes: 0x20
  417. 1044.1048: Size: 0x1a00
  418. 1044.1048: NT Headers: 0xc0
  419. 1044.1048: Timestamp: 0x562590e2
  420. 1044.1048: Machine: 0x8664 - amd64
  421. 1044.1048: Timestamp: 0x562590e2
  422. 1044.1048: Image Version: 6.1
  423. 1044.1048: SizeOfImage: 0x50000 (327680)
  424. 1044.1048: Resource Dir: 0x30000 LB 0x3f8
  425. 1044.1048: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  426. 1044.1048: [Raw version resource data: 0x30060 LB 0x398, codepage 0x0 (reserved 0x0)]
  427. 1044.1048: ProductName: Microsoft® Windows® Operating System
  428. 1044.1048: ProductVersion: 6.1.7601.19045
  429. 1044.1048: FileVersion: 6.1.7601.19045 (win7sp1_gdr.151019-1254)
  430. 1044.1048: FileDescription: ApiSet Schema DLL
  431. 1044.1048: supR3HardenedWinFindAdversaries: 0x0
  432. 1044.1048: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  433. 1044.1048: Calling main()
  434. 1044.1048: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  435. 1044.1048: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  436. 1044.1048: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  437. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  438. 1044.1048: SUPR3HardenedMain: Final process, opening VBoxDrv...
  439. 1044.1048: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000280000 LB 0x400000)
  440. 1044.1048: supR3HardNtEnableThreadCreation:
  441. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  442. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  443. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e3f40:C:\Windows\system32 [calling]
  444. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  445. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef5150000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  446. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  447. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  448. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  449. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5150000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  450. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  451. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  452. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5150000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  453. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5150000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  454. 1044.1048: \Device\HarddiskVolume3\Windows\System32\wintrust.dll: Owner is administrators group.
  455. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  456. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
  457. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  458. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  459. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\wintrust.dll)
  460. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wintrust.dll
  461. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  462. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  463. 1044.1048: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll: Owner is administrators group.
  464. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
  465. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  466. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  467. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  468. 1044.1048: \Device\HarddiskVolume3\Windows\System32\msasn1.dll: Owner is administrators group.
  469. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\msasn1.dll)
  470. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msasn1.dll
  471. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  472. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  473. 1044.1048: \Device\HarddiskVolume3\Windows\System32\crypt32.dll: Owner is administrators group.
  474. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  475. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  476. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\crypt32.dll)
  477. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  478. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  479. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  480. 1044.1048: \Device\HarddiskVolume3\Windows\System32\msvcrt.dll: Owner is administrators group.
  481. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\msvcrt.dll)
  482. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  483. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  484. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  485. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  486. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  487. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  488. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  489. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e3f40:C:\Windows\system32 [calling]
  490. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  491. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefce70000 LB 0x0003b000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
  492. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  493. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefd0f0000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
  494. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  495. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcf50000 LB 0x0016d000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
  496. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  497. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcd30000 LB 0x0000f000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
  498. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  499. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefecc0000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  500. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  501. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefce70000 'C:\Windows\system32\Wintrust.dll'
  502. 1044.1048: \Device\HarddiskVolume3\Windows\System32\bcrypt.dll: Owner is administrators group.
  503. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\bcrypt.dll)
  504. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  505. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007110d0:C:\Windows\system32 [calling]
  506. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  507. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc6b0000 LB 0x00022000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
  508. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  509. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6b0000 'C:\Windows\system32\bcrypt.dll'
  510. 1044.1048: bcrypt.dll loaded at 000007fefc6b0000, BCryptOpenAlgorithmProvider at 000007fefc6b2640, preloading providers:
  511. 1044.1048: \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll: Owner is administrators group.
  512. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  513. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
  514. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll)
  515. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  516. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  517. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  518. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  519. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  520. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  521. 1044.1048: \Device\HarddiskVolume3\Windows\System32\advapi32.dll: Owner is administrators group.
  522. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  523. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  524. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\advapi32.dll)
  525. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  526. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  527. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  528. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  529. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  530. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  531. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  532. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  533. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  534. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc0e0000 LB 0x0004c000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
  535. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  536. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff270000 LB 0x000db000 C:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
  537. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  538. 1044.1048: \Device\HarddiskVolume3\Windows\System32\sechost.dll: Owner is administrators group.
  539. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  540. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  541. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
  542. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
  543. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff560000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  544. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  545. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc0e0000 'C:\Windows\system32\bcryptprimitives.dll'
  546. 1044.1048: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000007126d0)
  547. 1044.1048: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000007156f0)
  548. 1044.1048: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=0000000000715810)
  549. 1044.1048: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=0000000000715a20)
  550. 1044.1048: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=0000000000715b40)
  551. 1044.1048: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=0000000000715c60)
  552. 1044.1048: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=0000000000715ea0)
  553. 1044.1048: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=0000000000715fd0)
  554. 1044.1048: \Device\HarddiskVolume3\Windows\System32\cryptsp.dll: Owner is administrators group.
  555. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\cryptsp.dll)
  556. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptsp.dll
  557. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  558. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  559. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  560. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  561. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  562. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  563. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  564. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  565. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc560000 LB 0x00018000 C:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
  566. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  567. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc560000 'C:\Windows\system32\CRYPTSP.dll'
  568. 1044.1048: \Device\HarddiskVolume3\Windows\System32\rsaenh.dll: Owner is administrators group.
  569. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  570. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rsaenh.dll)
  571. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  572. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  573. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  574. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  575. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  576. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  577. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc1a0000 LB 0x00047000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
  578. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  579. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc1a0000 'C:\Windows\system32\rsaenh.dll'
  580. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  581. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  582. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff270000 'C:\Windows\system32\ADVAPI32.dll'
  583. 1044.1048: \Device\HarddiskVolume3\Windows\System32\cryptbase.dll: Owner is administrators group.
  584. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\cryptbase.dll)
  585. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptbase.dll
  586. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  587. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  588. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcbd0000 LB 0x0000f000 C:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
  589. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  590. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbd0000 'C:\Windows\system32\CRYPTBASE.dll'
  591. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  592. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  593. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00000000770b0000 'C:\Windows\system32\kernel32.dll'
  594. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  595. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  596. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefce70000 'C:\Windows\system32\WINTRUST.DLL'
  597. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  598. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  599. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf50000 'C:\Windows\system32\CRYPT32.dll'
  600. 1044.1048: \Device\HarddiskVolume3\Windows\System32\imagehlp.dll: Owner is administrators group.
  601. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  602. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'advapi32.dll'.
  603. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\imagehlp.dll)
  604. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imagehlp.dll
  605. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  606. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  607. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  608. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  609. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  610. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  611. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imagehlp.dll (Input=imagehlp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  612. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  613. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefe6e0000 LB 0x00019000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
  614. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  615. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe6e0000 'C:\Windows\system32\imagehlp.dll'
  616. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  617. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  618. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc560000 'C:\Windows\system32\CRYPTSP.dll'
  619. 1044.1048: \Device\HarddiskVolume3\Windows\System32\user32.dll: Owner is administrators group.
  620. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  621. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\user32.dll)
  622. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\user32.dll
  623. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  624. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  625. 1044.1048: \Device\HarddiskVolume3\Windows\System32\gdi32.dll: Owner is administrators group.
  626. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  627. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
  628. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\gdi32.dll)
  629. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  630. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
  631. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume3\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
  632. 1044.1048: \Device\HarddiskVolume3\Windows\System32\lpk.dll: Owner is administrators group.
  633. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  634. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  635. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
  636. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\lpk.dll)
  637. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\lpk.dll
  638. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  639. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  640. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  641. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
  642. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume3\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
  643. 1044.1048: \Device\HarddiskVolume3\Windows\System32\usp10.dll: Owner is administrators group.
  644. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  645. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  646. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  647. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\usp10.dll)
  648. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\usp10.dll
  649. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  650. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  651. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  652. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  653. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  654. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  655. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  656. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  657. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  658. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  659. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  660. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  661. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  662. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  663. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  664. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USER32.dll (Input=USER32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  665. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  666. 1044.1048: supR3HardenedDllNotificationCallback: load 00000000771d0000 LB 0x0010b000 C:\Windows\system32\USER32.dll [fFlags=0x0]
  667. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  668. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff580000 LB 0x00067000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
  669. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  670. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefe6d0000 LB 0x0000e000 C:\Windows\system32\LPK.dll [fFlags=0x0]
  671. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\lpk.dll [lacks WinVerifyTrust]
  672. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefe330000 LB 0x000c9000 C:\Windows\system32\USP10.dll [fFlags=0x0]
  673. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\usp10.dll [lacks WinVerifyTrust]
  674. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  675. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  676. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff580000 'C:\Windows\system32\gdi32.dll'
  677. 1044.1048: \Device\HarddiskVolume3\Windows\System32\imm32.dll: Owner is administrators group.
  678. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  679. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  680. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
  681. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\imm32.dll)
  682. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imm32.dll
  683. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
  684. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume3\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
  685. 1044.1048: \Device\HarddiskVolume3\Windows\System32\msctf.dll: Owner is administrators group.
  686. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  687. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  688. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  689. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
  690. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\msctf.dll)
  691. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msctf.dll
  692. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  693. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  694. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  695. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  696. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  697. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  698. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  699. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  700. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  701. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  702. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  703. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  704. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  705. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  706. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  707. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  708. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  709. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  710. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  711. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  712. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff240000 LB 0x0002e000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
  713. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  714. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff0b0000 LB 0x00109000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
  715. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msctf.dll [lacks WinVerifyTrust]
  716. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff240000 'C:\Windows\system32\IMM32.DLL'
  717. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00000000771d0000 'C:\Windows\system32\USER32.dll'
  718. 1044.1048: \Device\HarddiskVolume3\Windows\System32\ncrypt.dll: Owner is administrators group.
  719. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
  720. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  721. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
  722. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\ncrypt.dll)
  723. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ncrypt.dll
  724. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  725. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  726. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  727. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  728. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  729. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  730. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  731. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  732. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  733. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ncrypt.dll (Input=ncrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  734. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  735. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc6e0000 LB 0x00050000 C:\Windows\system32\ncrypt.dll [fFlags=0x0]
  736. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  737. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6e0000 'C:\Windows\system32\ncrypt.dll'
  738. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  739. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (Input=bcrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  740. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6b0000 'C:\Windows\system32\bcrypt.dll'
  741. 1044.1048: \Device\HarddiskVolume3\Windows\System32\userenv.dll: Owner is administrators group.
  742. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  743. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  744. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
  745. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\userenv.dll)
  746. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\userenv.dll
  747. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  748. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  749. 1044.1048: \Device\HarddiskVolume3\Windows\System32\profapi.dll: Owner is administrators group.
  750. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  751. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\profapi.dll)
  752. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\profapi.dll
  753. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  754. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  755. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  756. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  757. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  758. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  759. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  760. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  761. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  762. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USERENV.dll (Input=USERENV.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  763. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  764. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcef0000 LB 0x0001e000 C:\Windows\system32\USERENV.dll [fFlags=0x0]
  765. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  766. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefcd40000 LB 0x0000f000 C:\Windows\system32\profapi.dll [fFlags=0x0]
  767. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  768. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcef0000 'C:\Windows\system32\USERENV.dll'
  769. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  770. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  771. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  772. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  773. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  774. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  775. 1044.1048: \Device\HarddiskVolume3\Windows\System32\gpapi.dll: Owner is administrators group.
  776. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  777. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  778. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\gpapi.dll)
  779. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gpapi.dll
  780. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  781. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  782. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  783. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  784. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  785. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  786. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\GPAPI.dll (Input=GPAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  787. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  788. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefc030000 LB 0x0001b000 C:\Windows\system32\GPAPI.dll [fFlags=0x0]
  789. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  790. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc030000 'C:\Windows\system32\GPAPI.dll'
  791. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  792. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  793. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  794. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  795. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  796. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefecc0000 'C:\Windows\system32\rpcrt4.dll'
  797. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  798. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  799. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-WIN-Service-Management-L2-1-0.dll'
  800. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  801. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  802. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  803. 1044.1048: \Device\HarddiskVolume3\Windows\System32\cryptnet.dll: Owner is administrators group.
  804. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  805. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  806. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  807. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'wldap32.dll'.
  808. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\cryptnet.dll)
  809. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptnet.dll
  810. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
  811. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume3\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
  812. 1044.1048: \Device\HarddiskVolume3\Windows\System32\Wldap32.dll: Owner is administrators group.
  813. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  814. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\Wldap32.dll)
  815. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\Wldap32.dll
  816. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  817. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  818. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  819. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  820. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  821. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  822. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  823. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  824. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  825. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  826. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  827. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  828. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  829. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  830. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefac80000 LB 0x00027000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
  831. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  832. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefe670000 LB 0x00052000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
  833. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
  834. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  835. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  836. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  837. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  838. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  839. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  840. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  841. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  842. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  843. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  844. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  845. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  846. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  847. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  848. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  849. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  850. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  851. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  852. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  853. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  854. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  855. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  856. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  857. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  858. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  859. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  860. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  861. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  862. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  863. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  864. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefac80000 'C:\Windows\system32\cryptnet.dll'
  865. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  866. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  867. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  868. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  869. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  870. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcd40000 'C:\Windows\system32\profapi.dll'
  871. 1044.1048: \Device\HarddiskVolume3\Windows\System32\shlwapi.dll: Owner is administrators group.
  872. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  873. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  874. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  875. 1044.1048: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\shlwapi.dll)
  876. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  877. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  878. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  879. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  880. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  881. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  882. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  883. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  884. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  885. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  886. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHLWAPI.dll (Input=SHLWAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  887. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  888. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefee90000 LB 0x00071000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
  889. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  890. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefee90000 'C:\Windows\system32\SHLWAPI.dll'
  891. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  892. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b6f40
  893. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  894. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9B1D637739FC6B271ED989F7454A98D5A76C1B7A
  895. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  896. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  897. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  898. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  899. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  900. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  901. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  902. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  903. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
  904. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  905. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  906. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff270000 'C:\Windows\system32\ADVAPI32.dll'
  907. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  908. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  909. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  910. 1044.1048: supR3HardenedIsApiSetDll: '<NULL>' -> true
  911. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  912. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007feff560000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  913. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\SystemRoot\System32\ntdll.dll'
  914. 1044.1048: g_pfnWinVerifyTrust=000007fefce71010
  915. 1044.1048: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  916. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e0 pwszName=\Device\HarddiskVolume3\Windows\System32\crypt32.dll
  917. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  918. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  919. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BFD41401EDEBD4D914977D62B588ECABEE60CFD3
  920. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_112_for_KB3040272~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\crypt32.dll'
  921. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  922. 1044.1048: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\crypt32.dll'
  923. 1044.1048: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  924. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d4 pwszName=\Device\HarddiskVolume3\Windows\System32\wintrust.dll
  925. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  926. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  927. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E1BBE4EB6D114F50142F24E2E2749EFD81021486
  928. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_75_for_KB3040272~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\wintrust.dll'
  929. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  930. 1044.1048: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\wintrust.dll'
  931. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000378 pwszName=\Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  932. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  933. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  934. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB8D9C9D3E1FC95D01F9A984B16ED031BB40CD8
  935. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'
  936. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  937. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'
  938. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000036c pwszName=\Device\HarddiskVolume3\Windows\System32\Wldap32.dll
  939. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  940. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  941. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87E73086F2528CF31D3AD5F0D71E04F8B942D5D8
  942. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\Wldap32.dll'
  943. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  944. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\Wldap32.dll'
  945. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000368 pwszName=\Device\HarddiskVolume3\Windows\System32\cryptnet.dll
  946. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  947. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  948. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=756DC088EE40CF9369C990D71B200F3CB59FC35D
  949. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_75_for_KB3040272~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
  950. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  951. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
  952. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000254 pwszName=\Device\HarddiskVolume3\Windows\System32\gpapi.dll
  953. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  954. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  955. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=470795C189226F7BDB8E50F42104CC34488B9340
  956. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\gpapi.dll'
  957. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  958. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gpapi.dll'
  959. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c0 pwszName=\Device\HarddiskVolume3\Windows\System32\profapi.dll
  960. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  961. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  962. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
  963. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\profapi.dll'
  964. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  965. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\profapi.dll'
  966. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001bc pwszName=\Device\HarddiskVolume3\Windows\System32\userenv.dll
  967. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  968. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  969. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3E1A2CC7367F751C19EBF4E6EDF5E9A10E47313
  970. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\userenv.dll'
  971. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  972. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\userenv.dll'
  973. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001a8 pwszName=\Device\HarddiskVolume3\Windows\System32\ncrypt.dll
  974. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  975. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  976. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DE8C9B0409BB6DC8348383C722B4EC4291BB2193
  977. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\ncrypt.dll'
  978. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  979. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ncrypt.dll'
  980. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000188 pwszName=\Device\HarddiskVolume3\Windows\System32\msctf.dll
  981. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  982. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  983. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=03916BC73EE5A0E312E3D3100D0ACE1B78E93BB1
  984. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3033889~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume3\Windows\System32\msctf.dll'
  985. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  986. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msctf.dll'
  987. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000018c pwszName=\Device\HarddiskVolume3\Windows\System32\imm32.dll
  988. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  989. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  990. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6EEE1AB3B6D79AFF857940FF5F51ED27698153EC
  991. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\imm32.dll'
  992. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  993. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll'
  994. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000184 pwszName=\Device\HarddiskVolume3\Windows\System32\usp10.dll
  995. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  996. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  997. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1F1AA8340DE02FC1B6341EE2706E55D56EDF63B8
  998. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2957509~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume3\Windows\System32\usp10.dll'
  999. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1000. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\usp10.dll'
  1001. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000180 pwszName=\Device\HarddiskVolume3\Windows\System32\lpk.dll
  1002. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1003. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1004. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FDBA63132AE4F561C5CFC5478222E40A2DAA2ACC
  1005. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3087039~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume3\Windows\System32\lpk.dll'
  1006. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1007. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\lpk.dll'
  1008. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1009. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1010. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1011. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=EB178841F5FFC6B05E668168217B0AC222A62955
  1012. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3069392~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\gdi32.dll'
  1013. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1014. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'
  1015. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000178 pwszName=\Device\HarddiskVolume3\Windows\System32\user32.dll
  1016. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1017. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1018. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=363EB3E556A5BDD1C604EEEF1AAEAAC6EACD0DD0
  1019. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1020. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b6f40
  1021. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1022. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=363EB3E556A5BDD1C604EEEF1AAEAAC6EACD0DD0
  1023. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1024. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b7540
  1025. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b7540
  1026. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=46A64E5748131D72AC512CB921D01F50BE94B4286127407D41ED0032DE7C1911
  1027. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1028. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1029. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: -22900 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\user32.dll'
  1030. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000174 pwszName=\Device\HarddiskVolume3\Windows\System32\imagehlp.dll
  1031. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1032. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1033. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2702EE05F1B717B0F2CE0FBE32784A47B8419DCA
  1034. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB2893294~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\imagehlp.dll'
  1035. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1036. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imagehlp.dll'
  1037. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000130 pwszName=\Device\HarddiskVolume3\Windows\System32\cryptbase.dll
  1038. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1039. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1040. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DD41E47CDA7ECDD58265F0739B9BC23E0761082B
  1041. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\cryptbase.dll'
  1042. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1043. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptbase.dll'
  1044. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rsaenh.dll'
  1045. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000012c pwszName=\Device\HarddiskVolume3\Windows\System32\cryptsp.dll
  1046. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1047. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1048. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BA7AC4A7E8ADDFEA90AC951ECB6D6546E4873613
  1049. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_115_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\cryptsp.dll'
  1050. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1051. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptsp.dll'
  1052. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000120 pwszName=\Device\HarddiskVolume3\Windows\System32\sechost.dll
  1053. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1054. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1055. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3FA2A014BF360CDC0E203A174FFC9DC5343C5323
  1056. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\sechost.dll'
  1057. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1058. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\sechost.dll'
  1059. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000011c pwszName=\Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1060. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1061. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1062. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7C0A1C638CE7C1160F49C473EC1420BD3AB693C4
  1063. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2882822~31bf3856ad364e35~amd64~~6.1.1.2.cat'; file='\Device\HarddiskVolume3\Windows\System32\advapi32.dll'
  1064. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1065. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\advapi32.dll'
  1066. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll'
  1067. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  1068. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1069. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1070. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62E377A1F0AD0C2EDC0A73CB3EFF841FF18D00D2
  1071. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\bcrypt.dll'
  1072. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1073. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll'
  1074. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e4 pwszName=\Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1075. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1076. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1077. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2CA2FD632B264C063162F71474266E3615B6420C
  1078. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB2654428~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume3\Windows\System32\msvcrt.dll'
  1079. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1080. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll'
  1081. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000dc pwszName=\Device\HarddiskVolume3\Windows\System32\msasn1.dll
  1082. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1083. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1084. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F2FF57DC30D774F93061607060DAA0DD15E39CCE
  1085. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\msasn1.dll'
  1086. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1087. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msasn1.dll'
  1088. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d8 pwszName=\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1089. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1090. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1091. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=35EB15A32FF6A8320A28B76654C7C05F183C0649
  1092. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll'
  1093. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1094. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll'
  1095. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1096. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  1097. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1098. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1099. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D187E2BFBA7ED9D015FB710000144445CAD8B2DE
  1100. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\KernelBase.dll'
  1101. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1102. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\KernelBase.dll'
  1103. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume3\Windows\System32\kernel32.dll
  1104. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1105. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1106. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3ABD4E7598BD11C4FA1AD66BF1B854BCC2A7C5DD
  1107. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_60_for_KB3101746~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\kernel32.dll'
  1108. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1109. 1044.1048: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel32.dll'
  1110. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1111. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007b9cb0:C:\Windows\system32 [calling]
  1112. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf50000 'C:\Windows\system32\crypt32.dll'
  1113. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1114. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1115. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1116. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1117. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  1118. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x89aff3418b3ce200 C=US, L=Silicon Valley, O=Authenticode, CN=Google
  1119. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1120. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1121. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
  1122. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1123. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  1124. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  1125. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  1126. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  1127. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1128. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1129. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  1130. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  1131. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  1132. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  1133. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1134. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  1135. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1136. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1137. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1138. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1139. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
  1140. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  1141. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x298be035a30bab00 C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2
  1142. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1143. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1144. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
  1145. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  1146. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1147. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  1148. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1149. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1150. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  1151. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  1152. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  1153. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1154. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  1155. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1156. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xe66b56ffc86e50a4 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA, Email=server-certs@thawte.com
  1157. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
  1158. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  1159. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1160. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xa8b43f38c3f7b100 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware
  1161. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  1162. 1044.1048: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1163. 1044.1048: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=50
  1164. 1044.1048: SUPR3HardenedMain: Load Runtime...
  1165. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1166. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1167. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  1168. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  1169. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  1170. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1171. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1172. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1173. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1174. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1175. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1176. 1044.1048: \Device\HarddiskVolume3\Windows\System32\ws2_32.dll: Owner is administrators group.
  1177. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000039c pwszName=\Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1178. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1179. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1180. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3EF3BDC1E84DFA17EA056313214EE88EC3E66F79
  1181. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\ws2_32.dll'
  1182. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1183. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1184. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1185. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
  1186. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ws2_32.dll) WinVerifyTrust
  1187. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1188. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1189. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1190. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1191. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  1192. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1193. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1194. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1195. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  1196. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1197. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1198. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1199. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1200. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  1201. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  1202. 1044.1048: \Device\HarddiskVolume3\Windows\System32\nsi.dll: Owner is administrators group.
  1203. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003f8 pwszName=\Device\HarddiskVolume3\Windows\System32\nsi.dll
  1204. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1205. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1206. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AFD8538945F2D05BC1AF949B9B19B7D2D9FBBF8
  1207. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\nsi.dll'
  1208. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1209. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\nsi.dll) WinVerifyTrust
  1210. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\nsi.dll
  1211. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1212. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1213. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1214. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1215. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1216. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1217. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000075d400:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1218. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1219. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef3b00000 LB 0x00590000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1220. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1221. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1222. 1044.1048: supR3HardenedDllNotificationCallback: load 000000006ccc0000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1223. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1224. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1225. 1044.1048: supR3HardenedDllNotificationCallback: load 00000000649b0000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1226. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1227. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefd190000 LB 0x0004d000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
  1228. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1229. 1044.1048: supR3HardenedDllNotificationCallback: load 000007feff0a0000 LB 0x00008000 C:\Windows\system32\NSI.dll [fFlags=0x0]
  1230. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\nsi.dll
  1231. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1232. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1233. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1234. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1235. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1236. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1237. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1238. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1239. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1240. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1241. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1242. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1243. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1244. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1245. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1246. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1247. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1248. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1249. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1250. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1251. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1252. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1253. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1254. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1255. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1256. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1257. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1258. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1259. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1260. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1261. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1262. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1263. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1264. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1265. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1266. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1267. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1268. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1269. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1270. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1271. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1272. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1273. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1274. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1275. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000006e4370:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\ProgramData\chocolatey\bin;C:\Users\Mustang\AppData\Local\Programs\Python\Launcher\ [calling]
  1276. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1277. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1278. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1279. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef3b00000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1280. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll
  1281. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000073a370:C:\Windows\system32 [calling]
  1282. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefce70000 'C:\Windows\system32\Wintrust.dll'
  1283. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1284. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000073a370:C:\Windows\system32 [calling]
  1285. 1044.1048: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf50000 'C:\Windows\system32\crypt32.dll'
  1286. 1044.1048: SUPR3HardenedMain: Load TrustedMain...
  1287. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1288. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1289. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  1290. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1291. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1292. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
  1293. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
  1294. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
  1295. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  1296. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1297. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  1298. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  1299. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  1300. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  1301. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
  1302. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll) WinVerifyTrust
  1303. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1304. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1305. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1306. 1044.1048: \Device\HarddiskVolume3\Windows\System32\winmm.dll: Owner is administrators group.
  1307. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000043c pwszName=\Device\HarddiskVolume3\Windows\System32\winmm.dll
  1308. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1309. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1310. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82E2B2A7826F88BEB98FFF0540C9BDB0A12F001A
  1311. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume3\Windows\System32\winmm.dll'
  1312. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1313. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1314. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1315. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmm.dll) WinVerifyTrust
  1316. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1317. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1318. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1319. 1044.1048: \Device\HarddiskVolume3\Windows\System32\oleaut32.dll: Owner is administrators group.
  1320. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000041c pwszName=\Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1321. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1322. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1323. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8A837B0D823EB506C6A4C447C1962174D27ED954
  1324. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3020338~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\oleaut32.dll'
  1325. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1326. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1327. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1328. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1329. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1330. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1331. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleaut32.dll) WinVerifyTrust
  1332. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1333. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1334. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1335. 1044.1048: \Device\HarddiskVolume3\Windows\System32\ole32.dll: Owner is administrators group.
  1336. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000448 pwszName=\Device\HarddiskVolume3\Windows\System32\ole32.dll
  1337. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1338. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1339. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E93C1851E5754D607F55581B4DE2A30B711C830
  1340. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB3072633~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume3\Windows\System32\ole32.dll'
  1341. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1342. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1343. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1344. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
  1345. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1346. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ole32.dll) WinVerifyTrust
  1347. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1348. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1349. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1350. 1044.1048: \Device\HarddiskVolume3\Windows\System32\shell32.dll: Owner is administrators group.
  1351. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000458 pwszName=\Device\HarddiskVolume3\Windows\System32\shell32.dll
  1352. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1353. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1354. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F81E827D2D12844C449C720D0161DE1E87833336
  1355. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1356. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b6f40
  1357. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1358. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F81E827D2D12844C449C720D0161DE1E87833336
  1359. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1360. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b7540
  1361. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b7540
  1362. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=C39938DF0CF89FAC614288F08985CBB60695C578BFE8E3DE7EF80723B07040FE
  1363. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1364. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b7540
  1365. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b7540
  1366. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=C39938DF0CF89FAC614288F08985CBB60695C578BFE8E3DE7EF80723B07040FE
  1367. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1368. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1369. 1044.1048: supHardenedWinVerifyImageByHandle: -> -22900 (\Device\HarddiskVolume3\Windows\System32\shell32.dll) WinVerifyTrust
  1370. 1044.1048: Error (rc=0):
  1371. 1044.1048: supR3HardenedScreenImage/Imports: rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume3\Windows\System32\shell32.dll: Not signed.
  1372. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1373. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1374. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1375. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1376. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1377. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1378. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1379. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1380. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1381. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1382. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1383. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1384. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1385. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1386. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
  1387. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
  1388. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1389. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1390. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
  1391. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1392. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1393. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1394. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
  1395. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
  1396. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll) WinVerifyTrust
  1397. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1398. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1399. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1400. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1401. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1402. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1403. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1404. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1405. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1406. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1407. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  1408. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1409. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1410. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1411. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1412. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1413. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1414. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1415. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1416. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1417. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1418. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll) WinVerifyTrust
  1419. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1420. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1421. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1422. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1423. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1424. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1425. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1426. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1427. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1428. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1429. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1430. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll) WinVerifyTrust
  1431. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1432. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1433. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1434. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1435. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1436. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1437. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1438. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1439. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1440. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1441. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1442. 1044.1048: \Device\HarddiskVolume3\Windows\System32\opengl32.dll: Owner is administrators group.
  1443. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000390 pwszName=\Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1444. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1445. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1446. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=608AC397FCC42B9FBAE25CB8C25EAF4C19AA384D
  1447. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
  1448. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1449. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1450. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1451. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1452. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
  1453. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
  1454. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1455. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\opengl32.dll) WinVerifyTrust
  1456. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1457. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1458. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1459. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
  1460. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume3\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
  1461. 1044.1048: \Device\HarddiskVolume3\Windows\System32\ddraw.dll: Owner is administrators group.
  1462. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000164 pwszName=\Device\HarddiskVolume3\Windows\System32\ddraw.dll
  1463. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1464. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1465. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
  1466. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume3\Windows\System32\ddraw.dll'
  1467. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1468. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1469. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1470. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
  1471. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1472. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  1473. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
  1474. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ddraw.dll) WinVerifyTrust
  1475. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ddraw.dll
  1476. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  1477. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  1478. 1044.1048: \Device\HarddiskVolume3\Windows\System32\glu32.dll: Owner is administrators group.
  1479. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003c8 pwszName=\Device\HarddiskVolume3\Windows\System32\glu32.dll
  1480. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1481. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1482. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60E45AB914E06A11F44EA76C6EF750AF892F9EA2
  1483. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume3\Windows\System32\glu32.dll'
  1484. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1485. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1486. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1487. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1488. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\glu32.dll) WinVerifyTrust
  1489. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\glu32.dll
  1490. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1491. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1492. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1493. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1494. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1495. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1496. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1497. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1498. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1499. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1500. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1501. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1502. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1503. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1504. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  1505. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  1506. 1044.1048: \Device\HarddiskVolume3\Windows\System32\mpr.dll: Owner is administrators group.
  1507. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000038c pwszName=\Device\HarddiskVolume3\Windows\System32\mpr.dll
  1508. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1509. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1510. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84FE9BA047B24E7694C9E0C349B48B9FD5F925B
  1511. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume3\Windows\System32\mpr.dll'
  1512. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1513. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mpr.dll) WinVerifyTrust
  1514. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mpr.dll
  1515. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1516. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1517. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1518. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1519. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1520. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1521. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1522. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1523. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1524. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1525. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1526. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1527. 1044.1048: Error (rc=0):
  1528. 1044.1048: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1529. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1530. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1531. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1532. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1533. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1534. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1535. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1536. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1537. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1538. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1539. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1540. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1541. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1542. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1543. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1544. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1545. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1546. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1547. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1548. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1549. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1550. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1551. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1552. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1553. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1554. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1555. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1556. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1557. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1558. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1559. 1044.1048: Error (rc=0):
  1560. 1044.1048: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=2 \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1561. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1562. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1563. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1564. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1565. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1566. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1567. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1568. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1569. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1570. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1571. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1572. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1573. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1574. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  1575. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume3\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  1576. 1044.1048: \Device\HarddiskVolume3\Windows\System32\comdlg32.dll: Owner is administrators group.
  1577. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e0 pwszName=\Device\HarddiskVolume3\Windows\System32\comdlg32.dll
  1578. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1579. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1580. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=66EE5BDFFA413AEA9E1FE7838A08646E94136DA5
  1581. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\comdlg32.dll'
  1582. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1583. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1584. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
  1585. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1586. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1587. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
  1588. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  1589. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\comdlg32.dll) WinVerifyTrust
  1590. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\comdlg32.dll
  1591. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  1592. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume3\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  1593. 1044.1048: \Device\HarddiskVolume3\Windows\System32\winspool.drv: Owner is administrators group.
  1594. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a8 pwszName=\Device\HarddiskVolume3\Windows\System32\winspool.drv
  1595. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1596. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1597. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C89A2ED7B99A056D78CA6BAC9CCAB8B1FF119A14
  1598. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume3\Windows\System32\winspool.drv'
  1599. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1600. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1601. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1602. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1603. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winspool.drv) WinVerifyTrust
  1604. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winspool.drv
  1605. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1606. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1607. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1608. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1609. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1610. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1611. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1612. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1613. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1614. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1615. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1616. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1617. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1618. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1619. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1620. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1621. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1622. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1623. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1624. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1625. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1626. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1627. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1628. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1629. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1630. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1631. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1632. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1633. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1634. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1635. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1636. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1637. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1638. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1639. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1640. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1641. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1642. 1044.1048: Error (rc=0):
  1643. 1044.1048: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=16 \Device\HarddiskVolume3\Windows\System32\user32.dll
  1644. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1645. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1646. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1647. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1648. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1649. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1650. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1651. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1652. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1653. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1654. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1655. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1656. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1657. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1658. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1659. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1660. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1661. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1662. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1663. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1664. 1044.1048: Error (rc=0):
  1665. 1044.1048: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=3 \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1666. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  1667. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  1668. 1044.1048: \Device\HarddiskVolume3\Windows\System32\comctl32.dll: Owner is administrators group.
  1669. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000046c pwszName=\Device\HarddiskVolume3\Windows\System32\comctl32.dll
  1670. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1671. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1672. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=761964761EE466757E306124E042F4C2ACBEA092
  1673. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3059317~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume3\Windows\System32\comctl32.dll'
  1674. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1675. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  1676. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1677. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1678. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\comctl32.dll) WinVerifyTrust
  1679. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\comctl32.dll
  1680. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1681. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1682. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1683. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1684. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1685. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1686. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  1687. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1688. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1689. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1690. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1691. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1692. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1693. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1694. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1695. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1696. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  1697. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  1698. 1044.1048: \Device\HarddiskVolume3\Windows\System32\dwmapi.dll: Owner is administrators group.
  1699. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b8 pwszName=\Device\HarddiskVolume3\Windows\System32\dwmapi.dll
  1700. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1701. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1702. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F3F3D4867E9140896E0742D7EE8AE1D01FE85ECE
  1703. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3078667~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume3\Windows\System32\dwmapi.dll'
  1704. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1705. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1706. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1707. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1708. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dwmapi.dll) WinVerifyTrust
  1709. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dwmapi.dll
  1710. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1711. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1712. 1044.1048: \Device\HarddiskVolume3\Windows\System32\setupapi.dll: Owner is administrators group.
  1713. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000398 pwszName=\Device\HarddiskVolume3\Windows\System32\setupapi.dll
  1714. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1715. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1716. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9A29CD7C19C8D5891A94D64F134132B97D9D5601
  1717. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1718. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b6f40
  1719. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1720. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9A29CD7C19C8D5891A94D64F134132B97D9D5601
  1721. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1722. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b7540
  1723. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b7540
  1724. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=65414D89C58DB027853147921C60EAA5934AF0C472D4AF4D5190E13C7501E838
  1725. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1726. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000007b7540
  1727. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b7540
  1728. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=65414D89C58DB027853147921C60EAA5934AF0C472D4AF4D5190E13C7501E838
  1729. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1730. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1731. 1044.1048: supHardenedWinVerifyImageByHandle: -> -22900 (\Device\HarddiskVolume3\Windows\System32\setupapi.dll) WinVerifyTrust
  1732. 1044.1048: Error (rc=0):
  1733. 1044.1048: supR3HardenedScreenImage/Imports: rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume3\Windows\System32\setupapi.dll: Not signed.
  1734. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  1735. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1736. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1737. 1044.1048: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1738. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
  1739. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume3\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
  1740. 1044.1048: \Device\HarddiskVolume3\Windows\System32\dciman32.dll: Owner is administrators group.
  1741. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000044c pwszName=\Device\HarddiskVolume3\Windows\System32\dciman32.dll
  1742. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000007b6f40
  1743. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000007b6f40
  1744. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=779E327CA47BE9830D08A18EEDE8A70C3A978A3B
  1745. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3087039~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume3\Windows\System32\dciman32.dll'
  1746. 1044.1048: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1747. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1748. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  1749. 1044.1048: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1750. 1044.1048: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dciman32.dll) WinVerifyTrust
  1751. 1044.1048: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dciman32.dll
  1752. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1753. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1754. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1755. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1756. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1757. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1758. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1759. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1760. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1761. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1762. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1763. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1764. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1765. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1766. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1767. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1768. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1769. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1770. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1771. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1772. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1773. 1044.1048: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1774. 1044.1048: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000075d400:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32 [calling]
  1775. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1776. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef30f0000 LB 0x00a06000 C:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  1777. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1778. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1779. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef4350000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [fFlags=0x0]
  1780. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1781. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\glu32.dll
  1782. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef4320000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [fFlags=0x0]
  1783. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\glu32.dll
  1784. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ddraw.dll
  1785. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef4220000 LB 0x000f1000 C:\Windows\system32\DDRAW.dll [fFlags=0x0]
  1786. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ddraw.dll
  1787. 1044.1048: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dciman32.dll
  1788. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fef5140000 LB 0x00008000 C:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
  1789. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dciman32.dll
  1790. 1044.1048: supR3HardenedDllNotificationCallback: load 000007fefe700000 LB 0x0043c000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
  1791. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  1792. 1044.1048: Error (rc=0):
  1793. 1044.1048: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  1794. 1044.1048: Fatal error:
  1795. 1044.1048: supR3HardenedDllNotificationCallback: supR3HardenedScreenImage failed on 'C:\Windows\system32\SETUPAPI.dll' / '\??\C:\Windows\system32\SETUPAPI.dll': 0xc0000190
  1796. 1038.103c: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2087 ms, the end);
  1797. 1030.1034: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2415 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!