API tools faq
paste
misdocumeno

VBoxHardening.log

misdocumeno
Sep 21st, 2020
136
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 410.71 KB | None | 0 0
raw download clone embed print report
  1. 2cc0.1340: Log file opened: 6.1.14r140239 g_hStartupLog=0000000000000070 g_uNtVerCombined=0xa0456300
  2. 2cc0.1340: \SystemRoot\System32\ntdll.dll:
  3. 2cc0.1340: CreationTime: 2018-09-15T07:28:45.608007200Z
  4. 2cc0.1340: LastWriteTime: 2018-09-15T07:28:45.608007200Z
  5. 2cc0.1340: ChangeTime: 2020-09-20T22:33:44.643316800Z
  6. 2cc0.1340: FileAttributes: 0x20
  7. 2cc0.1340: Size: 0x1e7cd0
  8. 2cc0.1340: NT Headers: 0xe0
  9. 2cc0.1340: Timestamp: 0xa369e897
  10. 2cc0.1340: Machine: 0x8664 - amd64
  11. 2cc0.1340: Timestamp: 0xa369e897
  12. 2cc0.1340: Image Version: 10.0
  13. 2cc0.1340: SizeOfImage: 0x1ed000 (2019328)
  14. 2cc0.1340: Resource Dir: 0x17d000 LB 0x6ea08
  15. 2cc0.1340: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 2cc0.1340: [Raw version resource data: 0x17d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 2cc0.1340: ProductName: Microsoft® Windows® Operating System
  18. 2cc0.1340: ProductVersion: 10.0.17763.1
  19. 2cc0.1340: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  20. 2cc0.1340: FileDescription: NT Layer DLL
  21. 2cc0.1340: \SystemRoot\System32\kernel32.dll:
  22. 2cc0.1340: CreationTime: 2018-09-15T07:28:44.342269900Z
  23. 2cc0.1340: LastWriteTime: 2018-09-15T07:28:44.342269900Z
  24. 2cc0.1340: ChangeTime: 2020-09-20T22:33:44.408376200Z
  25. 2cc0.1340: FileAttributes: 0x20
  26. 2cc0.1340: Size: 0xb1380
  27. 2cc0.1340: NT Headers: 0xe8
  28. 2cc0.1340: Timestamp: 0x65614da1
  29. 2cc0.1340: Machine: 0x8664 - amd64
  30. 2cc0.1340: Timestamp: 0x65614da1
  31. 2cc0.1340: Image Version: 10.0
  32. 2cc0.1340: SizeOfImage: 0xb3000 (733184)
  33. 2cc0.1340: Resource Dir: 0xb1000 LB 0x520
  34. 2cc0.1340: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 2cc0.1340: [Raw version resource data: 0xb10b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 2cc0.1340: ProductName: Microsoft® Windows® Operating System
  37. 2cc0.1340: ProductVersion: 10.0.17763.1
  38. 2cc0.1340: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  39. 2cc0.1340: FileDescription: Windows NT BASE API Client DLL
  40. 2cc0.1340: \SystemRoot\System32\KernelBase.dll:
  41. 2cc0.1340: CreationTime: 2018-09-15T07:28:45.389239100Z
  42. 2cc0.1340: LastWriteTime: 2018-09-15T07:28:45.404865800Z
  43. 2cc0.1340: ChangeTime: 2020-09-20T22:33:44.424598800Z
  44. 2cc0.1340: FileAttributes: 0x20
  45. 2cc0.1340: Size: 0x293cb8
  46. 2cc0.1340: NT Headers: 0xf8
  47. 2cc0.1340: Timestamp: 0xc3164c39
  48. 2cc0.1340: Machine: 0x8664 - amd64
  49. 2cc0.1340: Timestamp: 0xc3164c39
  50. 2cc0.1340: Image Version: 10.0
  51. 2cc0.1340: SizeOfImage: 0x293000 (2699264)
  52. 2cc0.1340: Resource Dir: 0x26f000 LB 0x548
  53. 2cc0.1340: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 2cc0.1340: [Raw version resource data: 0x26f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  55. 2cc0.1340: ProductName: Microsoft® Windows® Operating System
  56. 2cc0.1340: ProductVersion: 10.0.17763.1
  57. 2cc0.1340: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  58. 2cc0.1340: FileDescription: Windows NT BASE API Client DLL
  59. 2cc0.1340: \SystemRoot\System32\apisetschema.dll:
  60. 2cc0.1340: CreationTime: 2018-09-15T07:28:25.403122600Z
  61. 2cc0.1340: LastWriteTime: 2018-09-15T07:28:25.403122600Z
  62. 2cc0.1340: ChangeTime: 2020-09-20T23:26:56.996919300Z
  63. 2cc0.1340: FileAttributes: 0x20
  64. 2cc0.1340: Size: 0x1c738
  65. 2cc0.1340: NT Headers: 0xd0
  66. 2cc0.1340: Timestamp: 0x33775897
  67. 2cc0.1340: Machine: 0x8664 - amd64
  68. 2cc0.1340: Timestamp: 0x33775897
  69. 2cc0.1340: Image Version: 10.0
  70. 2cc0.1340: SizeOfImage: 0x1d000 (118784)
  71. 2cc0.1340: Resource Dir: 0x1c000 LB 0x408
  72. 2cc0.1340: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 2cc0.1340: [Raw version resource data: 0x1c060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  74. 2cc0.1340: ProductName: Microsoft® Windows® Operating System
  75. 2cc0.1340: ProductVersion: 10.0.17763.1
  76. 2cc0.1340: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  77. 2cc0.1340: FileDescription: ApiSet Schema DLL
  78. 2cc0.1340: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 2cc0.1340: supR3HardenedWinFindAdversaries: 0x0
  80. 2cc0.1340: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  81. 2cc0.1340: Calling main()
  82. 2cc0.1340: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  83. 2cc0.1340: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  84. 2cc0.1340: SUPR3HardenedMain: Respawn #1
  85. 2cc0.1340: System32: \Device\HarddiskVolume5\Windows\System32
  86. 2cc0.1340: WinSxS: \Device\HarddiskVolume5\Windows\WinSxS
  87. 2cc0.1340: KnownDllPath: C:\Windows\System32
  88. 2cc0.1340: supR3HardenedWinInit: Performing a limited self purification...
  89. 2cc0.1340: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
  90. 2cc0.1340: *0000000000000000-000000000097ffff 0x0001/0x0000 0x0000000
  91. 2cc0.1340: *0000000000980000-000000000098ffff 0x0004/0x0004 0x0040000
  92. 2cc0.1340: 0000000000990000-000000000099ffff 0x0001/0x0000 0x0000000
  93. 2cc0.1340: *00000000009a0000-00000000009b9fff 0x0002/0x0002 0x0040000
  94. 2cc0.1340: 00000000009ba000-00000000009bffff 0x0001/0x0000 0x0000000
  95. 2cc0.1340: *00000000009c0000-00000000009c3fff 0x0002/0x0002 0x0040000
  96. 2cc0.1340: 00000000009c4000-00000000009cffff 0x0001/0x0000 0x0000000
  97. 2cc0.1340: *00000000009d0000-00000000009d1fff 0x0004/0x0004 0x0020000
  98. 2cc0.1340: 00000000009d2000-00000000009fffff 0x0001/0x0000 0x0000000
  99. 2cc0.1340: *0000000000a00000-0000000000a33fff 0x0000/0x0004 0x0020000
  100. 2cc0.1340: 0000000000a34000-0000000000a36fff 0x0004/0x0004 0x0020000
  101. 2cc0.1340: 0000000000a37000-0000000000bfffff 0x0000/0x0004 0x0020000
  102. 2cc0.1340: *0000000000c00000-0000000000cb8fff 0x0000/0x0004 0x0020000
  103. 2cc0.1340: 0000000000cb9000-0000000000cbbfff 0x0104/0x0004 0x0020000
  104. 2cc0.1340: 0000000000cbc000-0000000000cfffff 0x0004/0x0004 0x0020000
  105. 2cc0.1340: *0000000000d00000-0000000000d01fff 0x0004/0x0004 0x0020000
  106. 2cc0.1340: 0000000000d02000-0000000000d31fff 0x0000/0x0004 0x0020000
  107. 2cc0.1340: 0000000000d32000-0000000000d7ffff 0x0001/0x0000 0x0000000
  108. 2cc0.1340: *0000000000d80000-0000000000d84fff 0x0004/0x0004 0x0020000
  109. 2cc0.1340: 0000000000d85000-0000000000e7ffff 0x0000/0x0004 0x0020000
  110. 2cc0.1340: *0000000000e80000-0000000000f44fff 0x0002/0x0002 0x0040000
  111. 2cc0.1340: 0000000000f45000-0000000000f4ffff 0x0001/0x0000 0x0000000
  112. 2cc0.1340: *0000000000f50000-0000000000f6cfff 0x0004/0x0004 0x0020000
  113. 2cc0.1340: 0000000000f6d000-000000000104ffff 0x0000/0x0004 0x0020000
  114. 2cc0.1340: 0000000001050000-000000000107ffff 0x0001/0x0000 0x0000000
  115. 2cc0.1340: *0000000001080000-000000000108efff 0x0004/0x0004 0x0020000
  116. 2cc0.1340: 000000000108f000-000000000108ffff 0x0000/0x0004 0x0020000
  117. 2cc0.1340: *0000000001090000-0000000001093fff 0x0000/0x0004 0x0020000
  118. 2cc0.1340: 0000000001094000-0000000001281fff 0x0004/0x0004 0x0020000
  119. 2cc0.1340: 0000000001282000-0000000001282fff 0x0000/0x0004 0x0020000
  120. 2cc0.1340: 0000000001283000-000000007ffdffff 0x0001/0x0000 0x0000000
  121. 2cc0.1340: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  122. 2cc0.1340: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  123. 2cc0.1340: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  124. 2cc0.1340: 000000007ffe4000-00007ff457f4ffff 0x0001/0x0000 0x0000000
  125. 2cc0.1340: *00007ff457f50000-00007ff457f54fff 0x0002/0x0002 0x0040000
  126. 2cc0.1340: 00007ff457f55000-00007ff45804ffff 0x0000/0x0002 0x0040000
  127. 2cc0.1340: *00007ff458050000-00007ff55806ffff 0x0000/0x0004 0x0020000
  128. 2cc0.1340: *00007ff558070000-00007ff55a06ffff 0x0000/0x0004 0x0020000
  129. 2cc0.1340: 00007ff55a070000-00007ff55a070fff 0x0004/0x0004 0x0020000
  130. 2cc0.1340: 00007ff55a071000-00007ff55a07ffff 0x0001/0x0000 0x0000000
  131. 2cc0.1340: *00007ff55a080000-00007ff55a080fff 0x0002/0x0002 0x0040000
  132. 2cc0.1340: 00007ff55a081000-00007ff55a08ffff 0x0001/0x0000 0x0000000
  133. 2cc0.1340: *00007ff55a090000-00007ff55a0b2fff 0x0002/0x0002 0x0040000
  134. 2cc0.1340: 00007ff55a0b3000-00007ff7b620ffff 0x0001/0x0000 0x0000000
  135. 2cc0.1340: *00007ff7b6210000-00007ff7b6210fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  136. 2cc0.1340: 00007ff7b6211000-00007ff7b6286fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  137. 2cc0.1340: 00007ff7b6287000-00007ff7b6287fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  138. 2cc0.1340: 00007ff7b6288000-00007ff7b62cffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  139. 2cc0.1340: 00007ff7b62d0000-00007ff7b62d2fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  140. 2cc0.1340: 00007ff7b62d3000-00007ff7b62d5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  141. 2cc0.1340: 00007ff7b62d6000-00007ff7b62d8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  142. 2cc0.1340: 00007ff7b62d9000-00007ff7b62d9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  143. 2cc0.1340: 00007ff7b62da000-00007ff7b62dbfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  144. 2cc0.1340: 00007ff7b62dc000-00007ff7b62dcfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  145. 2cc0.1340: 00007ff7b62dd000-00007ff7b6325fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  146. 2cc0.1340: 00007ff7b6326000-00007ffa577cffff 0x0001/0x0000 0x0000000
  147. 2cc0.1340: *00007ffa577d0000-00007ffa577d0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  148. 2cc0.1340: 00007ffa577d1000-00007ffa578d3fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  149. 2cc0.1340: 00007ffa578d4000-00007ffa57a29fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  150. 2cc0.1340: 00007ffa57a2a000-00007ffa57a2dfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  151. 2cc0.1340: 00007ffa57a2e000-00007ffa57a2efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  152. 2cc0.1340: 00007ffa57a2f000-00007ffa57a62fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  153. 2cc0.1340: 00007ffa57a63000-00007ffa588bffff 0x0001/0x0000 0x0000000
  154. 2cc0.1340: *00007ffa588c0000-00007ffa588c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  155. 2cc0.1340: 00007ffa588c1000-00007ffa58936fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  156. 2cc0.1340: 00007ffa58937000-00007ffa58968fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  157. 2cc0.1340: 00007ffa58969000-00007ffa58969fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  158. 2cc0.1340: 00007ffa5896a000-00007ffa5896afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  159. 2cc0.1340: 00007ffa5896b000-00007ffa58972fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  160. 2cc0.1340: 00007ffa58973000-00007ffa5ad7ffff 0x0001/0x0000 0x0000000
  161. 2cc0.1340: *00007ffa5ad80000-00007ffa5ad80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  162. 2cc0.1340: 00007ffa5ad81000-00007ffa5ae97fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  163. 2cc0.1340: 00007ffa5ae98000-00007ffa5aedefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  164. 2cc0.1340: 00007ffa5aedf000-00007ffa5aedffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  165. 2cc0.1340: 00007ffa5aee0000-00007ffa5aee1fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  166. 2cc0.1340: 00007ffa5aee2000-00007ffa5aee9fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  167. 2cc0.1340: 00007ffa5aeea000-00007ffa5af6cfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  168. 2cc0.1340: 00007ffa5af6d000-00007ffffffeffff 0x0001/0x0000 0x0000000
  169. 2cc0.1340: kernel32.dll: timestamp 0x65614da1 (rc=VINF_SUCCESS)
  170. 2cc0.1340: kernelbase.dll: timestamp 0xc3164c39 (rc=VINF_SUCCESS)
  171. 2cc0.1340: VirtualBoxVM.exe: timestamp 0x5f51ed66 (rc=VINF_SUCCESS)
  172. 2cc0.1340: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  173. 2cc0.1340: '\Device\HarddiskVolume5\Windows\System32\ntdll.dll' has no imports
  174. 2cc0.1340: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0
  175. 2cc0.1340: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  176. 2cc0.1340: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  177. 2cc0.1340: supR3HardNtEnableThreadCreationEx:
  178. 2cc0.1340: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffa5adf75d0 pvNtTerminateThread=00007ffa5ae1efe0
  179. 2cc0.1340: supR3HardenedWinDoReSpawn(1): New child 21dc.32b0 [kernel32].
  180. 2cc0.1340: supR3HardNtChildGatherData: PebBaseAddress=0000000000432000 cbPeb=0x388
  181. 2cc0.1340: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffa5ad80000 uNtDllChildAddr=00007ffa5ad80000
  182. 2cc0.1340: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffa5adf75d0
  183. 2cc0.1340: supR3HardenedWinSetupChildInit: Initial context:
  184. rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7b6217900 rdx=0000000000432000
  185. rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  186. r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  187. r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
  188. rip=00007ffa5ade7ab0 rsp=00000000006ffa98 rbp=0000000000000000 ctxflags=0010001b
  189. cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
  190. P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
  191. dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  192. dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  193. lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
  194. 2cc0.1340: supR3HardenedWinSetupChildInit: Start child.
  195. 2cc0.1340: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  196. 2cc0.1340: supR3HardNtChildPurify: Startup delay kludge #1/0: 260 ms, 29 sleeps
  197. 2cc0.1340: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  198. 2cc0.1340: *0000000000000000-000000000038ffff 0x0001/0x0000 0x0000000
  199. 2cc0.1340: *0000000000390000-00000000003affff 0x0004/0x0004 0x0020000
  200. 2cc0.1340: *00000000003b0000-00000000003c9fff 0x0002/0x0002 0x0040000
  201. 2cc0.1340: 00000000003ca000-00000000003cffff 0x0001/0x0000 0x0000000
  202. 2cc0.1340: *00000000003d0000-00000000003d3fff 0x0002/0x0002 0x0040000
  203. 2cc0.1340: 00000000003d4000-00000000003dffff 0x0001/0x0000 0x0000000
  204. 2cc0.1340: *00000000003e0000-00000000003e1fff 0x0004/0x0004 0x0020000
  205. 2cc0.1340: 00000000003e2000-00000000003fffff 0x0001/0x0000 0x0000000
  206. 2cc0.1340: *0000000000400000-0000000000431fff 0x0000/0x0004 0x0020000
  207. 2cc0.1340: 0000000000432000-0000000000434fff 0x0004/0x0004 0x0020000
  208. 2cc0.1340: 0000000000435000-00000000005fffff 0x0000/0x0004 0x0020000
  209. 2cc0.1340: *0000000000600000-00000000006fafff 0x0000/0x0004 0x0020000
  210. 2cc0.1340: 00000000006fb000-00000000006fdfff 0x0104/0x0004 0x0020000
  211. 2cc0.1340: 00000000006fe000-00000000006fffff 0x0004/0x0004 0x0020000
  212. 2cc0.1340: 0000000000700000-000000007ffdffff 0x0001/0x0000 0x0000000
  213. 2cc0.1340: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  214. 2cc0.1340: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  215. 2cc0.1340: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  216. 2cc0.1340: 000000007ffe4000-00007ff5e9a9ffff 0x0001/0x0000 0x0000000
  217. 2cc0.1340: *00007ff5e9aa0000-00007ff5e9aa0fff 0x0002/0x0002 0x0040000
  218. 2cc0.1340: 00007ff5e9aa1000-00007ff5e9aaffff 0x0001/0x0000 0x0000000
  219. 2cc0.1340: *00007ff5e9ab0000-00007ff5e9ad2fff 0x0002/0x0002 0x0040000
  220. 2cc0.1340: 00007ff5e9ad3000-00007ff7b620ffff 0x0001/0x0000 0x0000000
  221. 2cc0.1340: *00007ff7b6210000-00007ff7b6210fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  222. 2cc0.1340: 00007ff7b6211000-00007ff7b6286fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  223. 2cc0.1340: 00007ff7b6287000-00007ff7b6287fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  224. 2cc0.1340: 00007ff7b6288000-00007ff7b62cffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  225. 2cc0.1340: 00007ff7b62d0000-00007ff7b62d0fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  226. 2cc0.1340: 00007ff7b62d1000-00007ff7b62d1fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  227. 2cc0.1340: 00007ff7b62d2000-00007ff7b62d6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  228. 2cc0.1340: 00007ff7b62d7000-00007ff7b62d7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  229. 2cc0.1340: 00007ff7b62d8000-00007ff7b62d8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  230. 2cc0.1340: 00007ff7b62d9000-00007ff7b62dcfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  231. 2cc0.1340: 00007ff7b62dd000-00007ff7b6325fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  232. 2cc0.1340: 00007ff7b6326000-00007ffa5ad7ffff 0x0001/0x0000 0x0000000
  233. 2cc0.1340: *00007ffa5ad80000-00007ffa5ad80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  234. 2cc0.1340: 00007ffa5ad81000-00007ffa5ae97fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  235. 2cc0.1340: 00007ffa5ae98000-00007ffa5aedefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  236. 2cc0.1340: 00007ffa5aedf000-00007ffa5aee9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  237. 2cc0.1340: 00007ffa5aeea000-00007ffa5aef7fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  238. 2cc0.1340: 00007ffa5aef8000-00007ffa5aef8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  239. 2cc0.1340: 00007ffa5aef9000-00007ffa5aefbfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  240. 2cc0.1340: 00007ffa5aefc000-00007ffa5af6cfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  241. 2cc0.1340: 00007ffa5af6d000-00007ffffffeffff 0x0001/0x0000 0x0000000
  242. 2cc0.1340: supR3HardNtChildPurify: Done after 265 ms and 0 fixes (loop #0).
  243. 21dc.32b0: Log file opened: 6.1.14r140239 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa0456300
  244. 21dc.32b0: supR3HardenedVmProcessInit: uNtDllAddr=00007ffa5ad80000 g_uNtVerCombined=0xa0456300 (stack ~00000000006ff528)
  245. 21dc.32b0: ntdll.dll: timestamp 0xa369e897 (rc=VINF_SUCCESS)
  246. 21dc.32b0: New simple heap: #1 0000000000800000 LB 0x400000 (for 2019328 allocation)
  247. 2cc0.1340: supR3HardNtEnableThreadCreationEx:
  248. 21dc.32b0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  249. 21dc.32b0: System32: \Device\HarddiskVolume5\Windows\System32
  250. 21dc.32b0: WinSxS: \Device\HarddiskVolume5\Windows\WinSxS
  251. 21dc.32b0: KnownDllPath: C:\Windows\System32
  252. 21dc.32b0: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  253. 21dc.32b0: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  254. 21dc.32b0: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  255. 21dc.32b0: Registered Dll notification callback with NTDLL.
  256. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\kernel32.dll)
  257. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  258. 21dc.32b0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  259. 21dc.32b0: supR3HardenedDllNotificationCallback: load 00007ffa577d0000 LB 0x00293000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
  260. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\KernelBase.dll)
  261. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  262. 21dc.32b0: supR3HardenedDllNotificationCallback: load 00007ffa588c0000 LB 0x000b3000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
  263. 21dc.32b0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  264. 21dc.32b0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'C:\Windows\System32\KERNEL32.DLL'
  265. 21dc.32b0: supR3HardenedDllNotificationCallback: load 00007ff7b6210000 LB 0x00116000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
  266. 21dc.32b0: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  267. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  268. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  269. 21dc.32b0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffa5adf75d0 pvNtTerminateThread=00007ffa5ae1efe0
  270. 2cc0.1340: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 79 ms.
  271. 21dc.32b0: \SystemRoot\System32\ntdll.dll:
  272. 21dc.32b0: CreationTime: 2018-09-15T07:28:45.608007200Z
  273. 21dc.32b0: LastWriteTime: 2018-09-15T07:28:45.608007200Z
  274. 21dc.32b0: ChangeTime: 2020-09-20T22:33:44.643316800Z
  275. 21dc.32b0: FileAttributes: 0x20
  276. 21dc.32b0: Size: 0x1e7cd0
  277. 21dc.32b0: NT Headers: 0xe0
  278. 21dc.32b0: Timestamp: 0xa369e897
  279. 21dc.32b0: Machine: 0x8664 - amd64
  280. 21dc.32b0: Timestamp: 0xa369e897
  281. 21dc.32b0: Image Version: 10.0
  282. 21dc.32b0: SizeOfImage: 0x1ed000 (2019328)
  283. 21dc.32b0: Resource Dir: 0x17d000 LB 0x6ea08
  284. 21dc.32b0: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  285. 21dc.32b0: [Raw version resource data: 0x17d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  286. 21dc.32b0: ProductName: Microsoft® Windows® Operating System
  287. 21dc.32b0: ProductVersion: 10.0.17763.1
  288. 21dc.32b0: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  289. 21dc.32b0: FileDescription: NT Layer DLL
  290. 21dc.32b0: \SystemRoot\System32\kernel32.dll:
  291. 21dc.32b0: CreationTime: 2018-09-15T07:28:44.342269900Z
  292. 21dc.32b0: LastWriteTime: 2018-09-15T07:28:44.342269900Z
  293. 21dc.32b0: ChangeTime: 2020-09-20T22:33:44.408376200Z
  294. 21dc.32b0: FileAttributes: 0x20
  295. 21dc.32b0: Size: 0xb1380
  296. 21dc.32b0: NT Headers: 0xe8
  297. 21dc.32b0: Timestamp: 0x65614da1
  298. 21dc.32b0: Machine: 0x8664 - amd64
  299. 21dc.32b0: Timestamp: 0x65614da1
  300. 21dc.32b0: Image Version: 10.0
  301. 21dc.32b0: SizeOfImage: 0xb3000 (733184)
  302. 21dc.32b0: Resource Dir: 0xb1000 LB 0x520
  303. 21dc.32b0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  304. 21dc.32b0: [Raw version resource data: 0xb10b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  305. 21dc.32b0: ProductName: Microsoft® Windows® Operating System
  306. 21dc.32b0: ProductVersion: 10.0.17763.1
  307. 21dc.32b0: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  308. 21dc.32b0: FileDescription: Windows NT BASE API Client DLL
  309. 21dc.32b0: \SystemRoot\System32\KernelBase.dll:
  310. 21dc.32b0: CreationTime: 2018-09-15T07:28:45.389239100Z
  311. 21dc.32b0: LastWriteTime: 2018-09-15T07:28:45.404865800Z
  312. 21dc.32b0: ChangeTime: 2020-09-20T22:33:44.424598800Z
  313. 21dc.32b0: FileAttributes: 0x20
  314. 21dc.32b0: Size: 0x293cb8
  315. 21dc.32b0: NT Headers: 0xf8
  316. 21dc.32b0: Timestamp: 0xc3164c39
  317. 21dc.32b0: Machine: 0x8664 - amd64
  318. 21dc.32b0: Timestamp: 0xc3164c39
  319. 21dc.32b0: Image Version: 10.0
  320. 21dc.32b0: SizeOfImage: 0x293000 (2699264)
  321. 21dc.32b0: Resource Dir: 0x26f000 LB 0x548
  322. 21dc.32b0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  323. 21dc.32b0: [Raw version resource data: 0x26f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  324. 21dc.32b0: ProductName: Microsoft® Windows® Operating System
  325. 21dc.32b0: ProductVersion: 10.0.17763.1
  326. 21dc.32b0: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  327. 21dc.32b0: FileDescription: Windows NT BASE API Client DLL
  328. 21dc.32b0: \SystemRoot\System32\apisetschema.dll:
  329. 21dc.32b0: CreationTime: 2018-09-15T07:28:25.403122600Z
  330. 21dc.32b0: LastWriteTime: 2018-09-15T07:28:25.403122600Z
  331. 21dc.32b0: ChangeTime: 2020-09-20T23:26:56.996919300Z
  332. 21dc.32b0: FileAttributes: 0x20
  333. 21dc.32b0: Size: 0x1c738
  334. 21dc.32b0: NT Headers: 0xd0
  335. 21dc.32b0: Timestamp: 0x33775897
  336. 21dc.32b0: Machine: 0x8664 - amd64
  337. 21dc.32b0: Timestamp: 0x33775897
  338. 21dc.32b0: Image Version: 10.0
  339. 21dc.32b0: SizeOfImage: 0x1d000 (118784)
  340. 21dc.32b0: Resource Dir: 0x1c000 LB 0x408
  341. 21dc.32b0: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  342. 21dc.32b0: [Raw version resource data: 0x1c060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  343. 21dc.32b0: ProductName: Microsoft® Windows® Operating System
  344. 21dc.32b0: ProductVersion: 10.0.17763.1
  345. 21dc.32b0: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  346. 21dc.32b0: FileDescription: ApiSet Schema DLL
  347. 21dc.32b0: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  348. 21dc.32b0: supR3HardenedWinFindAdversaries: 0x0
  349. 21dc.32b0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  350. 21dc.32b0: Calling main()
  351. 21dc.32b0: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  352. 21dc.32b0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  353. 21dc.32b0: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  354. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  355. 21dc.32b0: SUPR3HardenedMain: Respawn #2
  356. 21dc.32b0: supR3HardNtEnableThreadCreationEx:
  357. 21dc.32b0: supR3HardenedDllNotificationCallback: load 00007ffa5a570000 LB 0x00123000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
  358. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll)
  359. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  360. 21dc.32b0: supR3HardenedDllNotificationCallback: load 00007ffa586a0000 LB 0x0009e000 C:\Windows\System32\sechost.dll [fFlags=0x0]
  361. 21dc.32b0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  362. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\sechost.dll)
  363. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\sechost.dll
  364. 21dc.32b0: '\Device\HarddiskVolume5\Windows\System32\ntdll.dll' has no imports
  365. 21dc.32b0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ntdll.dll)
  366. 21dc.32b0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  367. 21dc.32b0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  368. 21dc.32b0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  369. 21dc.32b0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  370. 21dc.32b0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  371. 21dc.32b0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5ad80000 'C:\Windows\System32\ntdll.dll'
  372. 21dc.32b0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffa5adf75d0 pvNtTerminateThread=00007ffa5ae1efe0
  373. 21dc.32b0: supR3HardenedWinDoReSpawn(2): New child 3088.3298 [kernel32].
  374. 21dc.32b0: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
  375. 21dc.32b0: supR3HardNtChildGatherData: PebBaseAddress=0000000001099000 cbPeb=0x388
  376. 21dc.32b0: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffa5ad80000 uNtDllChildAddr=00007ffa5ad80000
  377. 21dc.32b0: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffa5adf75d0
  378. 21dc.32b0: supR3HardenedWinSetupChildInit: Initial context:
  379. rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7b6217900 rdx=0000000001099000
  380. rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  381. r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  382. r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
  383. rip=00007ffa5ade7ab0 rsp=00000000012ff938 rbp=0000000000000000 ctxflags=0010001b
  384. cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
  385. P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
  386. dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  387. dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  388. lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
  389. 21dc.32b0: kernel32.dll: timestamp 0x65614da1 (rc=VINF_SUCCESS)
  390. 21dc.32b0: supR3HardenedWinSetupChildInit: Start child.
  391. 21dc.32b0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  392. 21dc.32b0: supR3HardNtChildPurify: Startup delay kludge #1/0: 257 ms, 30 sleeps
  393. 21dc.32b0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  394. 21dc.32b0: *0000000000000000-0000000000f1ffff 0x0001/0x0000 0x0000000
  395. 21dc.32b0: *0000000000f20000-0000000000f3ffff 0x0004/0x0004 0x0020000
  396. 21dc.32b0: *0000000000f40000-0000000000f59fff 0x0002/0x0002 0x0040000
  397. 21dc.32b0: 0000000000f5a000-0000000000f5ffff 0x0001/0x0000 0x0000000
  398. 21dc.32b0: *0000000000f60000-0000000000f63fff 0x0002/0x0002 0x0040000
  399. 21dc.32b0: 0000000000f64000-0000000000f6ffff 0x0001/0x0000 0x0000000
  400. 21dc.32b0: *0000000000f70000-0000000000f71fff 0x0004/0x0004 0x0020000
  401. 21dc.32b0: 0000000000f72000-0000000000ffffff 0x0001/0x0000 0x0000000
  402. 21dc.32b0: *0000000001000000-0000000001098fff 0x0000/0x0004 0x0020000
  403. 21dc.32b0: 0000000001099000-000000000109bfff 0x0004/0x0004 0x0020000
  404. 21dc.32b0: 000000000109c000-00000000011fffff 0x0000/0x0004 0x0020000
  405. 21dc.32b0: *0000000001200000-00000000012fafff 0x0000/0x0004 0x0020000
  406. 21dc.32b0: 00000000012fb000-00000000012fdfff 0x0104/0x0004 0x0020000
  407. 21dc.32b0: 00000000012fe000-00000000012fffff 0x0004/0x0004 0x0020000
  408. 21dc.32b0: 0000000001300000-000000007ffdffff 0x0001/0x0000 0x0000000
  409. 21dc.32b0: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  410. 21dc.32b0: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  411. 21dc.32b0: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  412. 21dc.32b0: 000000007ffe4000-00007ff5b142ffff 0x0001/0x0000 0x0000000
  413. 21dc.32b0: *00007ff5b1430000-00007ff5b1430fff 0x0002/0x0002 0x0040000
  414. 21dc.32b0: 00007ff5b1431000-00007ff5b143ffff 0x0001/0x0000 0x0000000
  415. 21dc.32b0: *00007ff5b1440000-00007ff5b1462fff 0x0002/0x0002 0x0040000
  416. 21dc.32b0: 00007ff5b1463000-00007ff7b620ffff 0x0001/0x0000 0x0000000
  417. 21dc.32b0: *00007ff7b6210000-00007ff7b6210fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  418. 21dc.32b0: 00007ff7b6211000-00007ff7b6286fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  419. 21dc.32b0: 00007ff7b6287000-00007ff7b6287fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  420. 21dc.32b0: 00007ff7b6288000-00007ff7b62cffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  421. 21dc.32b0: 00007ff7b62d0000-00007ff7b62d0fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  422. 21dc.32b0: 00007ff7b62d1000-00007ff7b62d1fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  423. 21dc.32b0: 00007ff7b62d2000-00007ff7b62d6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  424. 21dc.32b0: 00007ff7b62d7000-00007ff7b62d7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  425. 21dc.32b0: 00007ff7b62d8000-00007ff7b62d8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  426. 21dc.32b0: 00007ff7b62d9000-00007ff7b62dcfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  427. 21dc.32b0: 00007ff7b62dd000-00007ff7b6325fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  428. 21dc.32b0: 00007ff7b6326000-00007ffa5ad7ffff 0x0001/0x0000 0x0000000
  429. 21dc.32b0: *00007ffa5ad80000-00007ffa5ad80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  430. 21dc.32b0: 00007ffa5ad81000-00007ffa5ae97fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  431. 21dc.32b0: 00007ffa5ae98000-00007ffa5aedefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  432. 21dc.32b0: 00007ffa5aedf000-00007ffa5aee9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  433. 21dc.32b0: 00007ffa5aeea000-00007ffa5aef7fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  434. 21dc.32b0: 00007ffa5aef8000-00007ffa5aef8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  435. 21dc.32b0: 00007ffa5aef9000-00007ffa5aefbfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  436. 21dc.32b0: 00007ffa5aefc000-00007ffa5af6cfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  437. 21dc.32b0: 00007ffa5af6d000-00007ffffffeffff 0x0001/0x0000 0x0000000
  438. 21dc.32b0: VirtualBoxVM.exe: timestamp 0x5f51ed66 (rc=VINF_SUCCESS)
  439. 21dc.32b0: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  440. 21dc.32b0: '\Device\HarddiskVolume5\Windows\System32\ntdll.dll' has no imports
  441. 21dc.32b0: supR3HardNtChildPurify: Done after 281 ms and 0 fixes (loop #0).
  442. 3088.3298: Log file opened: 6.1.14r140239 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa0456300
  443. 3088.3298: supR3HardenedVmProcessInit: uNtDllAddr=00007ffa5ad80000 g_uNtVerCombined=0xa0456300 (stack ~00000000012ff3c8)
  444. 3088.3298: ntdll.dll: timestamp 0xa369e897 (rc=VINF_SUCCESS)
  445. 3088.3298: New simple heap: #1 0000000001400000 LB 0x400000 (for 2019328 allocation)
  446. 21dc.32b0: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000800000 LB 0x400000)
  447. 21dc.32b0: supR3HardNtEnableThreadCreationEx:
  448. 3088.3298: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  449. 3088.3298: System32: \Device\HarddiskVolume5\Windows\System32
  450. 3088.3298: WinSxS: \Device\HarddiskVolume5\Windows\WinSxS
  451. 3088.3298: KnownDllPath: C:\Windows\System32
  452. 3088.3298: supR3HardenedVmProcessInit: Opening vboxdrv...
  453. 3088.3298: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  454. 3088.3298: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  455. 3088.3298: Registered Dll notification callback with NTDLL.
  456. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\kernel32.dll)
  457. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  458. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  459. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa577d0000 LB 0x00293000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
  460. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\KernelBase.dll)
  461. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\KernelBase.dll
  462. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa588c0000 LB 0x000b3000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
  463. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  464. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'C:\Windows\System32\KERNEL32.DLL'
  465. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ff7b6210000 LB 0x00116000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
  466. 3088.3298: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  467. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  468. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  469. 3088.3298: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffa5adf75d0 pvNtTerminateThread=00007ffa5ae1efe0
  470. 21dc.32b0: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 68 ms.
  471. 3088.3298: \SystemRoot\System32\ntdll.dll:
  472. 3088.3298: CreationTime: 2018-09-15T07:28:45.608007200Z
  473. 3088.3298: LastWriteTime: 2018-09-15T07:28:45.608007200Z
  474. 3088.3298: ChangeTime: 2020-09-20T22:33:44.643316800Z
  475. 3088.3298: FileAttributes: 0x20
  476. 3088.3298: Size: 0x1e7cd0
  477. 3088.3298: NT Headers: 0xe0
  478. 3088.3298: Timestamp: 0xa369e897
  479. 3088.3298: Machine: 0x8664 - amd64
  480. 3088.3298: Timestamp: 0xa369e897
  481. 3088.3298: Image Version: 10.0
  482. 3088.3298: SizeOfImage: 0x1ed000 (2019328)
  483. 3088.3298: Resource Dir: 0x17d000 LB 0x6ea08
  484. 3088.3298: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  485. 3088.3298: [Raw version resource data: 0x17d0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  486. 3088.3298: ProductName: Microsoft® Windows® Operating System
  487. 3088.3298: ProductVersion: 10.0.17763.1
  488. 3088.3298: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  489. 3088.3298: FileDescription: NT Layer DLL
  490. 3088.3298: \SystemRoot\System32\kernel32.dll:
  491. 3088.3298: CreationTime: 2018-09-15T07:28:44.342269900Z
  492. 3088.3298: LastWriteTime: 2018-09-15T07:28:44.342269900Z
  493. 3088.3298: ChangeTime: 2020-09-20T22:33:44.408376200Z
  494. 3088.3298: FileAttributes: 0x20
  495. 3088.3298: Size: 0xb1380
  496. 3088.3298: NT Headers: 0xe8
  497. 3088.3298: Timestamp: 0x65614da1
  498. 3088.3298: Machine: 0x8664 - amd64
  499. 3088.3298: Timestamp: 0x65614da1
  500. 3088.3298: Image Version: 10.0
  501. 3088.3298: SizeOfImage: 0xb3000 (733184)
  502. 3088.3298: Resource Dir: 0xb1000 LB 0x520
  503. 3088.3298: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  504. 3088.3298: [Raw version resource data: 0xb10b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  505. 3088.3298: ProductName: Microsoft® Windows® Operating System
  506. 3088.3298: ProductVersion: 10.0.17763.1
  507. 3088.3298: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  508. 3088.3298: FileDescription: Windows NT BASE API Client DLL
  509. 3088.3298: \SystemRoot\System32\KernelBase.dll:
  510. 3088.3298: CreationTime: 2018-09-15T07:28:45.389239100Z
  511. 3088.3298: LastWriteTime: 2018-09-15T07:28:45.404865800Z
  512. 3088.3298: ChangeTime: 2020-09-20T22:33:44.424598800Z
  513. 3088.3298: FileAttributes: 0x20
  514. 3088.3298: Size: 0x293cb8
  515. 3088.3298: NT Headers: 0xf8
  516. 3088.3298: Timestamp: 0xc3164c39
  517. 3088.3298: Machine: 0x8664 - amd64
  518. 3088.3298: Timestamp: 0xc3164c39
  519. 3088.3298: Image Version: 10.0
  520. 3088.3298: SizeOfImage: 0x293000 (2699264)
  521. 3088.3298: Resource Dir: 0x26f000 LB 0x548
  522. 3088.3298: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  523. 3088.3298: [Raw version resource data: 0x26f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  524. 3088.3298: ProductName: Microsoft® Windows® Operating System
  525. 3088.3298: ProductVersion: 10.0.17763.1
  526. 3088.3298: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  527. 3088.3298: FileDescription: Windows NT BASE API Client DLL
  528. 3088.3298: \SystemRoot\System32\apisetschema.dll:
  529. 3088.3298: CreationTime: 2018-09-15T07:28:25.403122600Z
  530. 3088.3298: LastWriteTime: 2018-09-15T07:28:25.403122600Z
  531. 3088.3298: ChangeTime: 2020-09-20T23:26:56.996919300Z
  532. 3088.3298: FileAttributes: 0x20
  533. 3088.3298: Size: 0x1c738
  534. 3088.3298: NT Headers: 0xd0
  535. 3088.3298: Timestamp: 0x33775897
  536. 3088.3298: Machine: 0x8664 - amd64
  537. 3088.3298: Timestamp: 0x33775897
  538. 3088.3298: Image Version: 10.0
  539. 3088.3298: SizeOfImage: 0x1d000 (118784)
  540. 3088.3298: Resource Dir: 0x1c000 LB 0x408
  541. 3088.3298: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  542. 3088.3298: [Raw version resource data: 0x1c060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  543. 3088.3298: ProductName: Microsoft® Windows® Operating System
  544. 3088.3298: ProductVersion: 10.0.17763.1
  545. 3088.3298: FileVersion: 10.0.17763.1 (WinBuild.160101.0800)
  546. 3088.3298: FileDescription: ApiSet Schema DLL
  547. 3088.3298: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  548. 3088.3298: supR3HardenedWinFindAdversaries: 0x0
  549. 3088.3298: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  550. 3088.3298: Calling main()
  551. 3088.3298: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  552. 3088.3298: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox'
  553. 3088.3298: '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  554. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  555. 3088.3298: SUPR3HardenedMain: Final process, opening VBoxDrv...
  556. 3088.3298: supR3HardenedEarlyCompact: Removed heap 1 (0x00000001400000 LB 0x400000)
  557. 3088.3298: supR3HardNtEnableThreadCreationEx:
  558. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  559. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  560. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  561. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  562. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa53c50000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  563. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  564. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  565. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  566. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53c50000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  567. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  568. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  569. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53c50000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  570. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53c50000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  571. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  572. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msasn1.dll'.
  573. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  574. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  575. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wintrust.dll)
  576. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wintrust.dll
  577. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  578. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  579. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll)
  580. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  581. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  582. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume5\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  583. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'msasn1.dll'.
  584. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\crypt32.dll)
  585. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\crypt32.dll
  586. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  587. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume5\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  588. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msasn1.dll)
  589. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msasn1.dll
  590. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  591. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  592. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msvcrt.dll)
  593. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  594. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  595. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume5\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  596. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  597. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  598. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa585f0000 LB 0x0009e000 C:\Windows\System32\msvcrt.dll [fFlags=0x0]
  599. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  600. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56e30000 LB 0x00012000 C:\Windows\System32\MSASN1.dll [fFlags=0x0]
  601. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  602. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57670000 LB 0x000fc000 C:\Windows\System32\ucrtbase.dll [fFlags=0x0]
  603. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ucrtbase.dll)
  604. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ucrtbase.dll
  605. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57a70000 LB 0x001db000 C:\Windows\System32\CRYPT32.dll [fFlags=0x0]
  606. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  607. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5a570000 LB 0x00123000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
  608. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  609. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57770000 LB 0x00058000 C:\Windows\System32\Wintrust.dll [fFlags=0x0]
  610. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  611. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  612. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  613. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-synch-l1-2-0'
  614. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  615. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  616. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-fibers-l1-1-1'
  617. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  618. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  619. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-fibers-l1-1-1'
  620. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  621. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  622. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-synch-l1-2-0'
  623. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  624. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  625. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-localization-l1-2-1'
  626. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57770000 'C:\Windows\system32\Wintrust.dll'
  627. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\bcrypt.dll)
  628. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\bcrypt.dll
  629. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  630. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57c50000 LB 0x00026000 C:\Windows\System32\bcrypt.dll [fFlags=0x0]
  631. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  632. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57c50000 'C:\Windows\system32\bcrypt.dll'
  633. 3088.3298: bcrypt.dll loaded at 00007ffa57c50000, BCryptOpenAlgorithmProvider at 00007ffa57c54d60, preloading providers:
  634. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll)
  635. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll
  636. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  637. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57d20000 LB 0x0007e000 C:\Windows\System32\bcryptprimitives.dll [fFlags=0x0]
  638. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  639. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57d20000 'C:\Windows\system32\bcryptprimitives.dll'
  640. 3088.3298: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000018be510)
  641. 3088.3298: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000018bf270)
  642. 3088.3298: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=00000000018bf570)
  643. 3088.3298: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=00000000018bf870)
  644. 3088.3298: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=00000000018bfb70)
  645. 3088.3298: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000018bfe70)
  646. 3088.3298: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000018c0170)
  647. 3088.3298: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=00000000018c0470)
  648. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56f00000 LB 0x00017000 C:\Windows\System32\CRYPTSP.dll [fFlags=0x0]
  649. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\cryptsp.dll)
  650. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\cryptsp.dll
  651. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
  652. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\rsaenh.dll)
  653. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\rsaenh.dll
  654. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  655. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  656. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  657. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  658. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  659. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa561d0000 LB 0x00033000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
  660. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  661. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  662. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
  663. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\cryptbase.dll)
  664. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\cryptbase.dll
  665. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa567e0000 LB 0x0000c000 C:\Windows\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
  666. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  667. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  668. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  669. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  670. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  671. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  672. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'C:\Windows\System32\kernel32.dll'
  673. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  674. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  675. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57770000 'C:\Windows\System32\WINTRUST.DLL'
  676. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  677. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  678. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\CRYPT32.dll'
  679. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57fb0000 LB 0x0001d000 C:\Windows\System32\imagehlp.dll [fFlags=0x0]
  680. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\imagehlp.dll)
  681. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\imagehlp.dll
  682. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  683. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  684. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  685. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa586a0000 LB 0x0009e000 C:\Windows\System32\sechost.dll [fFlags=0x0]
  686. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  687. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\sechost.dll)
  688. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\sechost.dll
  689. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  690. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  691. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\gpapi.dll)
  692. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\gpapi.dll
  693. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55a90000 LB 0x00022000 C:\Windows\SYSTEM32\gpapi.dll [fFlags=0x0]
  694. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  695. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56e00000 LB 0x00024000 C:\Windows\System32\profapi.dll [fFlags=0x0]
  696. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\profapi.dll)
  697. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\profapi.dll
  698. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  699. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
  700. 3088.3298: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume5\Windows\System32\cryptnet.dll)
  701. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\cryptnet.dll
  702. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  703. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume5\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  704. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  705. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  706. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  707. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  708. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  709. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  710. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  711. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  712. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  713. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  714. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  715. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  716. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  717. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  718. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  719. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa523d0000 LB 0x0002f000 C:\Windows\System32\cryptnet.dll [fFlags=0x0]
  720. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  721. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  722. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  723. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  724. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  725. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  726. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  727. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  728. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  729. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  730. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  731. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  732. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  733. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  734. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  735. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  736. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  737. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  738. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  739. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  740. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  741. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  742. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  743. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  744. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  745. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  746. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  747. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  748. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  749. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  750. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  751. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa523d0000 'C:\Windows\System32\cryptnet.dll'
  752. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5a980000 LB 0x000a3000 C:\Windows\System32\advapi32.dll [fFlags=0x0]
  753. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  754. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
  755. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  756. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\advapi32.dll)
  757. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  758. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  759. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  760. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  761. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  762. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
  763. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume5\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
  764. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  765. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  766. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  767. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  768. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  769. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  770. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  771. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  772. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  773. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  774. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: New context 0000000001904cc0
  775. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  776. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=012AB69DCBC7DE8A0108C7B62F7637F3689E88E8
  777. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  778. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  779. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5a570000 'C:\Windows\System32\rpcrt4.dll'
  780. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  781. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  782. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  783. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  784. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  785. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  786. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0316~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\SystemRoot\System32\ntdll.dll'
  787. 3088.3298: g_pfnWinVerifyTrust=00007ffa57776370
  788. 3088.3298: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  789. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  790. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  791. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  792. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  793. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  794. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  795. 3088.3298: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\crypt32.dll'
  796. 3088.3298: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  797. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  798. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  799. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  800. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll
  801. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  802. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  803. 3088.3298: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\wintrust.dll'
  804. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  805. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  806. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  807. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  808. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\advapi32.dll'
  809. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000384 pwszName=\Device\HarddiskVolume5\Windows\System32\cryptnet.dll
  810. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  811. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  812. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A71FAF93E7F6555CF5752D6A603A870E378E49E6
  813. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  814. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  815. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  816. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0316~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\cryptnet.dll'
  817. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  818. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\cryptnet.dll'
  819. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  820. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  821. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  822. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\profapi.dll'
  823. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  824. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  825. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  826. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\gpapi.dll'
  827. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  828. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  829. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  830. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\sechost.dll'
  831. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  832. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  833. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  834. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\imagehlp.dll'
  835. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  836. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  837. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  838. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\cryptbase.dll'
  839. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  840. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  841. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll
  842. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  843. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  844. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\rsaenh.dll'
  845. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll
  846. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  847. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  848. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  849. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\cryptsp.dll'
  850. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  851. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  852. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll'
  853. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  854. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  855. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\bcrypt.dll'
  856. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  857. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  858. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\ucrtbase.dll'
  859. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  860. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  861. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll'
  862. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  863. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  864. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\msasn1.dll'
  865. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  866. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  867. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll'
  868. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  869. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  870. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  871. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe'
  872. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  873. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  874. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\KernelBase.dll'
  875. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  876. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  877. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\kernel32.dll'
  878. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\system32\crypt32.dll'
  879. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  880. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  881. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  882. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
  883. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  884. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  885. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  886. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
  887. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  888. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  889. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
  890. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  891. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  892. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  893. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  894. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  895. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  896. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  897. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  898. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  899. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  900. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  901. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  902. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  903. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  904. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  905. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
  906. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  907. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  908. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  909. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  910. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
  911. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  912. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  913. 3088.3298: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  914. 3088.3298: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=35
  915. 3088.3298: SUPR3HardenedMain: Load Runtime...
  916. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  917. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  918. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  919. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  920. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  921. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  922. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  923. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  924. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  925. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  926. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  927. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  928. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ws2_32.dll) WinVerifyTrust
  929. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  930. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  931. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  932. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  933. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  934. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  935. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  936. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  937. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  938. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  939. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  940. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  941. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  942. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  943. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  944. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  945. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  946. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  947. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll)
  948. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  949. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  950. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  951. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  952. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  953. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  954. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  955. 3088.3298: supR3HardenedDllNotificationCallback: load 000000006c700000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  956. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  957. 3088.3298: supR3HardenedDllNotificationCallback: load 000000006bb80000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  958. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  959. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5a880000 LB 0x0006d000 C:\Windows\System32\WS2_32.dll [fFlags=0x0]
  960. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  961. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa037d0000 LB 0x005e0000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  962. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  963. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  964. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  965. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  966. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  967. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  968. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  969. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  970. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  971. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  972. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  973. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  974. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  975. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  976. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  977. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  978. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  979. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  980. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  981. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  982. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  983. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  984. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  985. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  986. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  987. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  988. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  989. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  990. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  991. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  992. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  993. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  994. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  995. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  996. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  997. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  998. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  999. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1000. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1001. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1002. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1003. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1004. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1005. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1006. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1007. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1008. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1009. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1010. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1011. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1012. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1013. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1014. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1015. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1016. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1017. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1018. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1019. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1020. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1021. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1022. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1023. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1024. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1025. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1026. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1027. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1028. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1029. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1030. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1031. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1032. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1033. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1034. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1035. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1036. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1037. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1038. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1039. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1040. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1041. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1042. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1043. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1044. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1045. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1046. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1047. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1048. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1049. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1050. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1051. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1052. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1053. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1054. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1055. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1056. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1057. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1058. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1059. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1060. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1061. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1062. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1063. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1064. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1065. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1066. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1067. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1068. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1069. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1070. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1071. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1072. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1073. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1074. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1075. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1076. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1077. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1078. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1079. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1080. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1081. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1082. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1083. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1084. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1085. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1086. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1087. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1088. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1089. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1090. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1091. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1092. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1093. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1094. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1095. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1096. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1097. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1098. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1099. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1100. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1101. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1102. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1103. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1104. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1105. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1106. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1107. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1108. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1109. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1110. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1111. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1112. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1113. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1114. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1115. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1116. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1117. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1118. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1119. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1120. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1121. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1122. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1123. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1124. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1125. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1126. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1127. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1128. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1129. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1130. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1131. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1132. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1133. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1134. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1135. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1136. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1137. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1138. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1139. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa037d0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1140. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1141. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll'
  1142. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wintrust.dll
  1143. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1144. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57770000 'C:\Windows\system32\Wintrust.dll'
  1145. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll
  1146. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1147. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1148. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1149. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1150. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1151. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\system32\crypt32.dll'
  1152. 3088.3298: SUPR3HardenedMain: Load TrustedMain...
  1153. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1154. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1155. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'uicommon.dll'.
  1156. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1157. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcp100.dll'.
  1158. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcr100.dll'.
  1159. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5corevbox.dll'.
  1160. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5guivbox.dll'.
  1161. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5widgetsvbox.dll'.
  1162. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  1163. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1164. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'ole32.dll'.
  1165. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'oleaut32.dll'.
  1166. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'winmm.dll'.
  1167. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll) WinVerifyTrust
  1168. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  1169. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1170. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1171. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1172. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1173. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'winmmbase.dll'.
  1174. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  1175. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\winmm.dll) WinVerifyTrust
  1176. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\winmm.dll
  1177. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1178. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1179. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1180. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1181. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  1182. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
  1183. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
  1184. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1185. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1186. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\winmmbase.dll)
  1187. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\winmmbase.dll
  1188. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1189. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1190. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  1191. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1192. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll
  1193. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1194. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1195. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1196. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
  1197. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  1198. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\oleaut32.dll) WinVerifyTrust
  1199. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  1200. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1201. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1202. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1203. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1204. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  1205. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1206. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1207. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1208. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1209. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'bcryptprimitives.dll'.
  1210. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\combase.dll)
  1211. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\combase.dll
  1212. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1213. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1214. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1215. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll)
  1216. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  1217. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  1218. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  1219. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll
  1220. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1221. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1222. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1223. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1224. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'rpcrt4.dll'.
  1225. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #55 'gdi32.dll'.
  1226. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'user32.dll'.
  1227. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'combase.dll'.
  1228. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ole32.dll) WinVerifyTrust
  1229. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ole32.dll
  1230. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1231. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1232. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1233. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1234. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1235. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1236. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1237. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1238. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1239. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
  1240. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\user32.dll)
  1241. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\user32.dll
  1242. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1243. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1244. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1245. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\gdi32.dll)
  1246. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\gdi32.dll
  1247. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1248. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1249. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1250. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1251. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1252. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1253. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1254. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1255. 3088.3298: '\Device\HarddiskVolume5\Windows\System32\win32u.dll' has no imports
  1256. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\win32u.dll)
  1257. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\win32u.dll
  1258. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1259. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1260. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1261. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
  1262. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\user32.dll) WinVerifyTrust
  1263. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1264. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1265. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1266. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1267. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1268. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1269. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1270. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1271. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1272. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1273. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1274. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1275. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1276. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1277. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1278. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1279. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1280. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1281. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1282. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1283. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1284. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1285. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'.
  1286. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1287. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1288. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1289. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1290. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1291. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1292. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1293. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1294. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll)
  1295. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1296. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1297. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1298. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'.
  1299. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1300. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1301. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1302. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1303. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1304. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1305. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1306. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll)
  1307. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1308. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1309. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1310. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1311. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1312. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1313. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1314. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1315. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1316. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1317. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1318. 3088.3298: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll)
  1319. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1320. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1321. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1322. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1323. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1324. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1325. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  1326. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1327. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1328. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1329. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1330. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #75 'user32.dll'.
  1331. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #77 'gdi32.dll'.
  1332. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\shell32.dll)
  1333. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\shell32.dll
  1334. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1335. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1336. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1337. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1338. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1339. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  1340. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1341. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1342. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1343. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1344. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1345. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1346. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1347. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1348. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1349. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1350. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1351. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  1352. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1353. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1354. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1355. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1356. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1357. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1358. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1359. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1360. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1361. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1362. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume5\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1363. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\opengl32.dll'.
  1364. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1365. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  1366. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1367. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1368. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'glu32.dll'.
  1369. 3088.3298: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume5\Windows\System32\opengl32.dll)
  1370. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\opengl32.dll
  1371. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1372. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1373. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  1374. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1375. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1376. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1377. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1378. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1379. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  1380. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  1381. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  1382. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1383. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\mpr.dll)
  1384. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\mpr.dll
  1385. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1386. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1387. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  1388. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1389. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1390. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  1391. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1392. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1393. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  1394. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1395. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1396. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll [lacks WinVerifyTrust]
  1397. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1398. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1399. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1400. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  1401. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  1402. 3088.3298: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1403. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1404. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1405. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'opengl32.dll'.
  1406. 3088.3298: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume5\Windows\System32\glu32.dll)
  1407. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\glu32.dll
  1408. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1409. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1410. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1411. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1412. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1413. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1414. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1415. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1416. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  1417. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1418. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1419. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  1420. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1421. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1422. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1423. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1424. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1425. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1426. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1427. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1428. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  1429. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1430. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume5\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1431. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
  1432. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1433. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1434. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1435. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1436. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1437. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1438. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1439. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1440. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1441. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1442. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1443. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1444. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1445. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  1446. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1447. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1448. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [redoing WinVerifyTrust]
  1449. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1450. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1451. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1452. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1453. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1454. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  1455. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1456. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1457. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll [lacks WinVerifyTrust]
  1458. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1459. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1460. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1461. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1462. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1463. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  1464. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1465. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1466. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1467. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1468. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1469. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1470. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1471. 3088.3298: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'
  1472. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1473. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1474. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
  1475. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1476. 3088.3298: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'
  1477. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1478. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1479. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  1480. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1481. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1482. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  1483. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1484. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1485. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uicommon.dll'...
  1486. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\uicommon.dll' [rcNtRedir=0xc0150008]
  1487. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1488. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
  1489. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcr100.dll'.
  1490. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1491. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1492. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5widgetsvbox.dll'.
  1493. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1494. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  1495. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ole32.dll'.
  1496. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  1497. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  1498. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\UICommon.dll) WinVerifyTrust
  1499. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\UICommon.dll
  1500. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1501. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume5\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1502. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\opengl32.dll [redoing WinVerifyTrust]
  1503. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000045c pwszName=\Device\HarddiskVolume5\Windows\System32\opengl32.dll
  1504. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  1505. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  1506. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F9EA7A084F8D34EE062D8C0EF5D96EF865883D56
  1507. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1508. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1509. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1510. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1511. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  1512. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1513. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1514. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  1515. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1516. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1517. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  1518. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1519. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1520. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1521. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1522. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1523. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
  1524. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1525. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1526. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1527. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1528. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1529. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1530. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1531. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1532. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1533. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1534. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  1535. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  1536. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0112~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\opengl32.dll'
  1537. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1538. 3088.3298: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\opengl32.dll'
  1539. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  1540. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  1541. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\opengl32.dll
  1542. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\UICommon.dll
  1543. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1544. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1545. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
  1546. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1547. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  1548. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  1549. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  1550. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
  1551. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57f40000 LB 0x00020000 C:\Windows\System32\win32u.dll [fFlags=0x0]
  1552. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
  1553. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57c80000 LB 0x000a0000 C:\Windows\System32\msvcp_win.dll [fFlags=0x0]
  1554. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
  1555. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57da0000 LB 0x0019a000 C:\Windows\System32\gdi32full.dll [fFlags=0x0]
  1556. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1557. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1558. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'user32.dll'.
  1559. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'win32u.dll'.
  1560. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\gdi32full.dll)
  1561. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\gdi32full.dll
  1562. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa59fd0000 LB 0x00029000 C:\Windows\System32\GDI32.dll [fFlags=0x0]
  1563. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
  1564. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57fd0000 LB 0x00197000 C:\Windows\System32\USER32.dll [fFlags=0x0]
  1565. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [avoiding WinVerifyTrust]
  1566. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa47ce0000 LB 0x0002c000 C:\Windows\SYSTEM32\GLU32.dll [fFlags=0x0]
  1567. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume5\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  1568. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa16a30000 LB 0x00127000 C:\Windows\SYSTEM32\OPENGL32.dll [fFlags=0x0]
  1569. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\opengl32.dll
  1570. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa57f60000 LB 0x0004a000 C:\Windows\System32\cfgmgr32.dll [fFlags=0x0]
  1571. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll)
  1572. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll
  1573. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa58170000 LB 0x0032e000 C:\Windows\System32\combase.dll [fFlags=0x0]
  1574. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll [avoiding WinVerifyTrust]
  1575. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa58810000 LB 0x000a8000 C:\Windows\System32\shcore.dll [fFlags=0x0]
  1576. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1577. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'rpcrt4.dll'.
  1578. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
  1579. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\SHCore.dll)
  1580. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\SHCore.dll
  1581. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56da0000 LB 0x0005d000 C:\Windows\System32\powrprof.dll [fFlags=0x0]
  1582. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  1583. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\powrprof.dll)
  1584. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\powrprof.dll
  1585. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa584a0000 LB 0x00052000 C:\Windows\System32\shlwapi.dll [fFlags=0x0]
  1586. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1587. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'gdi32.dll'.
  1588. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'user32.dll'.
  1589. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\shlwapi.dll)
  1590. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\shlwapi.dll
  1591. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56d80000 LB 0x00011000 C:\Windows\System32\kernel.appcore.dll [fFlags=0x0]
  1592. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
  1593. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  1594. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll)
  1595. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll
  1596. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56f20000 LB 0x00748000 C:\Windows\System32\windows.storage.dll [fFlags=0x0]
  1597. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
  1598. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
  1599. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'rpcrt4.dll'.
  1600. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'profapi.dll'.
  1601. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\windows.storage.dll)
  1602. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\windows.storage.dll
  1603. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa58ae0000 LB 0x014ef000 C:\Windows\System32\SHELL32.dll [fFlags=0x0]
  1604. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll [avoiding WinVerifyTrust]
  1605. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa58980000 LB 0x00155000 C:\Windows\System32\ole32.dll [fFlags=0x0]
  1606. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  1607. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa425e0000 LB 0x0001a000 C:\Windows\SYSTEM32\MPR.dll [fFlags=0x0]
  1608. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  1609. 3088.3298: supR3HardenedDllNotificationCallback: load 000000006c190000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  1610. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1611. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa031d0000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  1612. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1613. 3088.3298: supR3HardenedDllNotificationCallback: load 000000006bc20000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  1614. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
  1615. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa58740000 LB 0x000cb000 C:\Windows\System32\OLEAUT32.dll [fFlags=0x0]
  1616. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  1617. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa03db0000 LB 0x02317000 C:\Program Files\Oracle\VirtualBox\UICommon.dll [fFlags=0x0]
  1618. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\UICommon.dll
  1619. 3088.3298: supR3HardenedDllNotificationCallback: load 000000006bb20000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  1620. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1621. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa52a40000 LB 0x0002d000 C:\Windows\SYSTEM32\WINMMBASE.dll [fFlags=0x0]
  1622. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
  1623. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa52a70000 LB 0x00024000 C:\Windows\SYSTEM32\WINMM.dll [fFlags=0x0]
  1624. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  1625. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa478a0000 LB 0x001c8000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll [fFlags=0x0]
  1626. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  1627. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1628. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1629. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1630. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1631. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1632. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1633. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1634. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1635. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1636. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1637. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1638. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1639. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1640. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1641. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1642. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1643. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1644. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1645. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1646. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1647. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1648. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1649. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1650. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1651. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1652. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1653. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1654. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1655. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1656. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1657. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1658. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1659. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1660. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1661. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  1662. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1663. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1664. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\profapi.dll
  1665. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1666. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1667. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1668. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1669. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  1670. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1671. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  1672. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1673. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1674. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll [redoing WinVerifyTrust]
  1675. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1676. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\combase.dll
  1677. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1678. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1679. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1680. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1681. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1682. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1683. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [redoing WinVerifyTrust]
  1684. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1685. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\user32.dll
  1686. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1687. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1688. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1689. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1690. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\gdi32.dll
  1691. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1692. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1693. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1694. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1695. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1696. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1697. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll [redoing WinVerifyTrust]
  1698. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1699. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\combase.dll
  1700. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1701. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1702. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1703. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1704. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1705. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1706. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1707. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1708. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\win32u.dll
  1709. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1710. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1711. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [redoing WinVerifyTrust]
  1712. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1713. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\user32.dll
  1714. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1715. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1716. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1717. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1718. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\gdi32.dll
  1719. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1720. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1721. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  1722. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1723. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  1724. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1725. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'C:\Windows\System32\kernel32.dll'
  1726. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1727. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1728. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1729. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1730. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1731. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1732. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1733. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1734. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1735. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1736. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1737. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1738. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1739. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1740. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1741. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1742. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1743. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1744. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1745. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1746. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1747. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1748. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1749. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1750. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1751. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1752. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1753. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1754. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1755. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1756. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1757. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1758. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1759. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1760. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1761. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1762. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1763. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1764. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1765. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1766. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1767. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1768. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1769. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1770. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1771. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1772. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1773. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1774. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1775. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1776. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1777. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1778. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1779. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1780. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1781. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1782. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1783. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1784. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1785. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1786. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1787. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1788. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1789. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1790. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1791. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1792. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1793. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1794. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  1795. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1796. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-string-l1-1-0'
  1797. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1798. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1799. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1800. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1801. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1802. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1803. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1804. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1805. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1806. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1807. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1808. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1809. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1810. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1811. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1812. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1813. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1814. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1815. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1816. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1817. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1818. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1819. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1820. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1821. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1822. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1823. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1824. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1825. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1826. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1827. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1828. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1829. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1830. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1831. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1832. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1833. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1834. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1835. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1836. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1837. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1838. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1839. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1840. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1841. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1842. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1843. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1844. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1845. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1846. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1847. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1848. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1849. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1850. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1851. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1852. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1853. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1854. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1855. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1856. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1857. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1858. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1859. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1860. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1861. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1862. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1863. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1864. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1865. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  1866. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1867. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-datetime-l1-1-1'
  1868. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1869. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1870. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1871. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1872. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1873. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1874. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1875. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1876. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1877. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1878. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1879. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1880. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1881. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1882. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1883. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1884. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1885. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1886. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1887. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1888. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1889. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1890. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1891. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1892. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1893. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1894. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1895. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1896. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1897. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1898. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1899. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1900. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1901. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1902. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1903. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1904. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1905. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1906. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1907. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1908. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1909. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1910. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1911. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1912. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1913. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1914. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1915. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1916. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1917. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1918. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1919. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1920. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1921. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1922. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1923. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1924. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1925. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1926. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1927. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1928. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1929. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1930. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1931. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1932. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1933. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1934. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1935. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1936. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  1937. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1938. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-localization-obsolete-l1-2-0'
  1939. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1940. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1941. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1942. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1943. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1944. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1945. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1946. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1947. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1948. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1949. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1950. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1951. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1952. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1953. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1954. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1955. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1956. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1957. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1958. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1959. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1960. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1961. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1962. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1963. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1964. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1965. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  1966. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  1967. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  1968. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  1969. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  1970. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  1971. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  1972. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  1973. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  1974. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  1975. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  1976. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  1977. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  1978. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  1979. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  1980. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  1981. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  1982. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  1983. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  1984. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  1985. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  1986. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  1987. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  1988. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  1989. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  1990. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  1991. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  1992. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  1993. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1994. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  1995. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  1996. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  1997. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  1998. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  1999. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  2000. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  2001. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  2002. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  2003. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  2004. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  2005. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  2006. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  2007. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\imm32.dll'.
  2008. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  2009. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
  2010. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\imm32.dll)
  2011. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\imm32.dll
  2012. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2013. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2014. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  2015. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  2016. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\win32u.dll
  2017. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2018. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2019. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll [redoing WinVerifyTrust]
  2020. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  2021. 3088.3298: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume5\Windows\System32\user32.dll
  2022. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2023. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5a950000 LB 0x0002e000 C:\Windows\System32\IMM32.DLL [fFlags=0x0]
  2024. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
  2025. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5a950000 'C:\Windows\system32\IMM32.DLL'
  2026. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\imm32.dll'.
  2027. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\imm32.dll' [rescheduled]
  2028. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  2029. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  2030. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  2031. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  2032. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  2033. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  2034. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  2035. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  2036. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  2037. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  2038. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  2039. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  2040. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  2041. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  2042. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  2043. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  2044. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  2045. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  2046. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  2047. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  2048. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2049. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2050. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  2051. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  2052. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  2053. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  2054. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  2055. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  2056. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  2057. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  2058. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  2059. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  2060. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  2061. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  2062. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\imm32.dll'.
  2063. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\imm32.dll' [rescheduled]
  2064. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  2065. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  2066. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  2067. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  2068. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  2069. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  2070. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  2071. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  2072. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  2073. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  2074. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  2075. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  2076. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  2077. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  2078. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  2079. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  2080. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  2081. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  2082. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  2083. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  2084. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2085. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2086. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  2087. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  2088. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  2089. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  2090. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  2091. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  2092. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  2093. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  2094. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  2095. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  2096. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  2097. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  2098. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  2099. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2100. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5a980000 'C:\Windows\System32\ADVAPI32.DLL'
  2101. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\imm32.dll'.
  2102. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\imm32.dll' [rescheduled]
  2103. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'.
  2104. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll' [rescheduled]
  2105. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'.
  2106. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll' [rescheduled]
  2107. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'.
  2108. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rescheduled]
  2109. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'.
  2110. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll' [rescheduled]
  2111. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'.
  2112. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll' [rescheduled]
  2113. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'.
  2114. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rescheduled]
  2115. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'.
  2116. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll' [rescheduled]
  2117. 3088.3298: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume5\Windows\System32\glu32.dll'.
  2118. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll' [rescheduled]
  2119. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\mpr.dll'.
  2120. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll' [rescheduled]
  2121. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\shell32.dll'.
  2122. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rescheduled]
  2123. 3088.3298: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2124. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2125. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\win32u.dll'.
  2126. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rescheduled]
  2127. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'.
  2128. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rescheduled]
  2129. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\user32.dll'.
  2130. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rescheduled]
  2131. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'.
  2132. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rescheduled]
  2133. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\combase.dll'.
  2134. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rescheduled]
  2135. 3088.3298: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'.
  2136. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rescheduled]
  2137. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa478a0000 'C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll'
  2138. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2139. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2140. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\imm32.dll'
  2141. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2142. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2143. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\windows.storage.dll'
  2144. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2145. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2146. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\kernel.appcore.dll'
  2147. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2148. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2149. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll'
  2150. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2151. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2152. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\powrprof.dll'
  2153. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2154. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2155. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\SHCore.dll'
  2156. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2157. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2158. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll'
  2159. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2160. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2161. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\gdi32full.dll'
  2162. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000448 pwszName=\Device\HarddiskVolume5\Windows\System32\glu32.dll
  2163. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2164. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2165. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=45FF4C1DBC7AE18A1DA512455F13BC17EA659425
  2166. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2167. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2168. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0112~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\glu32.dll'
  2169. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2170. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\glu32.dll'
  2171. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2172. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2173. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\mpr.dll'
  2174. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2175. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2176. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\shell32.dll'
  2177. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2178. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'
  2179. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2180. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2181. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\win32u.dll'
  2182. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2183. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2184. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\gdi32.dll'
  2185. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2186. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2187. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\user32.dll'
  2188. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2189. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2190. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll'
  2191. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2192. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2193. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\combase.dll'
  2194. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2195. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2196. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll'
  2197. 3088.3298: SUPR3HardenedMain: Calling TrustedMain (00007ffa478a16c0)...
  2198. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2199. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2200. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  2201. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  2202. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  2203. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  2204. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2205. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2206. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  2207. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  2208. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  2209. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  2210. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  2211. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2212. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2213. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2214. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2215. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2216. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2217. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2218. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2219. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2220. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2221. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2222. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  2223. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2224. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume5\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2225. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll
  2226. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2227. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2228. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2229. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2230. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2231. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  2232. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2233. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume5\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2234. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\imm32.dll
  2235. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2236. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2237. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2238. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2239. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  2240. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2241. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2242. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2243. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2244. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa0fb90000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  2245. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2246. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa0fb90000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  2247. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000620 pwszName=\Device\HarddiskVolume5\Windows\System32\uxtheme.dll
  2248. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2249. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2250. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9E9C9DBAFB6FF286F236C72F471A61F524EAC54D
  2251. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rsaenh.dll
  2252. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2253. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2254. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2255. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0315~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\uxtheme.dll'
  2256. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2257. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2258. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  2259. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
  2260. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\uxtheme.dll) WinVerifyTrust
  2261. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\uxtheme.dll
  2262. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2263. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2264. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2265. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2266. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2267. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2268. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2269. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\uxtheme.dll
  2270. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55160000 LB 0x0009c000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
  2271. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\uxtheme.dll
  2272. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa55160000 'C:\Windows\system32\uxtheme.dll'
  2273. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57fd0000 'C:\Windows\system32\user32.dll'
  2274. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll
  2275. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2276. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58ae0000 'C:\Windows\system32\shell32.dll'
  2277. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\SHCore.dll
  2278. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2279. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58810000 'C:\Windows\system32\SHCore.dll'
  2280. 3088.3298: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\Windows\system32\wintab32.dll': 0 (NtPath=\??\C:\Windows\system32\wintab32.dll; Input=C:\Windows\system32\wintab32.dll; rcNtGetDll=0x0
  2281. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\Windows\system32\wintab32.dll'
  2282. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2283. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'crypt32.dll'.
  2284. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'cryptsp.dll'.
  2285. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'win32u.dll'.
  2286. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'user32.dll'.
  2287. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'gdi32.dll'.
  2288. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\dwmapi.dll)
  2289. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\dwmapi.dll
  2290. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa554a0000 LB 0x0002e000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
  2291. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dwmapi.dll [avoiding WinVerifyTrust]
  2292. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2293. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2294. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2295. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2296. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\user32.dll
  2297. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2298. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2299. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll
  2300. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cryptsp.dll'...
  2301. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'cryptsp.dll' -> '\Device\HarddiskVolume5\Windows\System32\cryptsp.dll' [rcNtRedir=0xc0150008]
  2302. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\cryptsp.dll
  2303. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  2304. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume5\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  2305. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2306. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2307. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2308. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2309. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\dwmapi.dll'
  2310. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  2311. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2312. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\system32\winmm.dll'
  2313. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  2314. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2315. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\system32\winmm.dll'
  2316. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll
  2317. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2318. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58ae0000 'C:\Windows\system32\shell32.dll'
  2319. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\uxtheme.dll
  2320. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2321. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa55160000 'C:\Windows\system32\uxtheme.dll'
  2322. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  2323. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\advapi32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2324. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5a980000 'C:\Windows\system32\advapi32.dll'
  2325. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2326. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2327. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  2328. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'profapi.dll'.
  2329. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\userenv.dll) WinVerifyTrust
  2330. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\userenv.dll
  2331. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  2332. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  2333. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\profapi.dll
  2334. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2335. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2336. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  2337. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\userenv.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2338. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\userenv.dll
  2339. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa56cb0000 LB 0x00028000 C:\Windows\system32\userenv.dll [fFlags=0x0]
  2340. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\userenv.dll
  2341. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa56cb0000 'C:\Windows\system32\userenv.dll'
  2342. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\kernel32.dll
  2343. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2344. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'C:\Windows\System32\kernel32.dll'
  2345. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5a7d0000 LB 0x000a2000 C:\Windows\System32\clbcatq.dll [fFlags=0x0]
  2346. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2347. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'rpcrt4.dll'.
  2348. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\clbcatq.dll)
  2349. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\clbcatq.dll
  2350. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2351. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2352. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2353. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2354. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2355. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2356. 3088.19a4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\clbcatq.dll'
  2357. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2358. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2359. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2360. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2361. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  2362. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  2363. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  2364. 3088.19a4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
  2365. 3088.19a4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxC.dll
  2366. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2367. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2368. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2369. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2370. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2371. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  2372. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2373. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2374. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  2375. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2376. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2377. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2378. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2379. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll
  2380. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2381. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2382. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2383. 3088.19a4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxC.dll
  2384. 3088.19a4: supR3HardenedDllNotificationCallback: load 00007ffa02e10000 LB 0x003c0000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  2385. 3088.19a4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxC.dll
  2386. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa02e10000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  2387. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2388. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2389. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2390. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  2391. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
  2392. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  2393. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  2394. 3088.19a4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  2395. 3088.19a4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
  2396. 3088.19a4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  2397. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2398. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2399. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2400. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2401. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2402. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2403. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2404. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  2405. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2406. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2407. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shlwapi.dll
  2408. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2409. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2410. 3088.19a4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\advapi32.dll
  2411. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2412. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2413. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2414. 3088.19a4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2415. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2416. 3088.19a4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  2417. 3088.19a4: supR3HardenedDllNotificationCallback: load 00007ffa16940000 LB 0x000ef000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
  2418. 3088.19a4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  2419. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa16940000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
  2420. 3088.19a4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2421. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2422. 3088.19a4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58740000 'C:\Windows\System32\oleaut32.dll'
  2423. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa59fd0000 'C:\Windows\system32\gdi32.dll'
  2424. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll
  2425. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2426. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58ae0000 'C:\Windows\system32\shell32.dll'
  2427. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2428. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2429. 3088.3298: '\Device\HarddiskVolume5\Windows\System32\ntdll.dll' has no imports
  2430. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ntdll.dll) WinVerifyTrust
  2431. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ntdll.dll
  2432. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2433. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5ad80000 'C:\Windows\System32\ntdll.dll'
  2434. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa5abe0000 LB 0x0016a000 C:\Windows\System32\MSCTF.dll [fFlags=0x0]
  2435. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2436. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'oleaut32.dll'.
  2437. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
  2438. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
  2439. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'imm32.dll'.
  2440. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msctf.dll)
  2441. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msctf.dll
  2442. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2443. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume5\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2444. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\imm32.dll
  2445. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2446. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2447. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2448. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2449. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2450. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2451. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2452. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2453. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2454. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  2455. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2456. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2457. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\msctf.dll'
  2458. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000978 pwszName=\Device\HarddiskVolume5\Windows\System32\DataExchange.dll
  2459. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2460. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2461. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=59F3AE35C1BD7FF73B733C35DF45575279B981AF
  2462. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2463. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2464. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0310~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\DataExchange.dll'
  2465. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2466. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2467. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'shcore.dll'.
  2468. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'combase.dll'.
  2469. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'd3d11.dll'.
  2470. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'dcomp.dll'.
  2471. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\DataExchange.dll) WinVerifyTrust
  2472. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\DataExchange.dll
  2473. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
  2474. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' -> '\Device\HarddiskVolume5\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
  2475. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2476. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2477. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  2478. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp_win.dll'.
  2479. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'oleaut32.dll'.
  2480. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'dxgi.dll'.
  2481. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\dcomp.dll) WinVerifyTrust
  2482. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\dcomp.dll
  2483. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
  2484. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume5\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
  2485. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
  2486. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume5\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
  2487. 3088.3298: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\dxgi.dll'.
  2488. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2489. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'win32u.dll'.
  2490. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\dxgi.dll)
  2491. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\dxgi.dll
  2492. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2493. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2494. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\oleaut32.dll
  2495. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2496. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2497. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  2498. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2499. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2500. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll
  2501. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2502. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2503. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll
  2504. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2505. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2506. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2507. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2508. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2509. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'dxgi.dll'.
  2510. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'win32u.dll'.
  2511. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\d3d11.dll) WinVerifyTrust
  2512. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\d3d11.dll
  2513. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2514. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2515. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll
  2516. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  2517. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume5\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  2518. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\SHCore.dll
  2519. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2520. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2521. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2522. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2523. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\win32u.dll
  2524. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
  2525. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume5\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
  2526. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dxgi.dll [redoing WinVerifyTrust]
  2527. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2528. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2529. 3088.3298: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\dxgi.dll'
  2530. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2531. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2532. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2533. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\DataExchange.dll
  2534. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\d3d11.dll
  2535. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dcomp.dll
  2536. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dxgi.dll
  2537. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55be0000 LB 0x000c2000 C:\Windows\system32\dxgi.dll [fFlags=0x0]
  2538. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dxgi.dll
  2539. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa540e0000 LB 0x0027e000 C:\Windows\system32\d3d11.dll [fFlags=0x0]
  2540. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\d3d11.dll
  2541. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa54920000 LB 0x001c3000 C:\Windows\system32\dcomp.dll [fFlags=0x0]
  2542. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dcomp.dll
  2543. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa39270000 LB 0x00056000 C:\Windows\system32\dataexchange.dll [fFlags=0x0]
  2544. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\DataExchange.dll
  2545. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\gdi32.dll
  2546. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2547. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa59fd0000 'C:\Windows\System32\gdi32.dll'
  2548. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa39270000 'C:\Windows\system32\dataexchange.dll'
  2549. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rmclient.dll'.
  2550. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'rpcrt4.dll'.
  2551. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'combase.dll'.
  2552. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'msvcp_win.dll'.
  2553. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\twinapi.appcore.dll)
  2554. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\twinapi.appcore.dll
  2555. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2556. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  2557. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\rmclient.dll)
  2558. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\rmclient.dll
  2559. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55790000 LB 0x00028000 C:\Windows\system32\RMCLIENT.dll [fFlags=0x0]
  2560. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rmclient.dll [avoiding WinVerifyTrust]
  2561. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55580000 LB 0x0020d000 C:\Windows\system32\twinapi.appcore.dll [fFlags=0x0]
  2562. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
  2563. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2564. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2565. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2566. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2567. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2568. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2569. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  2570. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2571. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2572. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll
  2573. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2574. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2575. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rmclient.dll'...
  2576. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rmclient.dll' -> '\Device\HarddiskVolume5\Windows\System32\rmclient.dll' [rcNtRedir=0xc0150008]
  2577. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rmclient.dll [lacks WinVerifyTrust]
  2578. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2579. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\crypt32.dll
  2580. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2581. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2582. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\rmclient.dll'
  2583. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2584. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2585. 3088.3298: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\twinapi.appcore.dll'
  2586. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\SHCore.dll
  2587. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shcore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2588. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58810000 'C:\Windows\system32\Shcore.dll'
  2589. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ole32.dll
  2590. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2591. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58980000 'C:\Windows\System32\ole32.dll'
  2592. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58740000 'C:\Windows\System32\OLEAUT32.dll'
  2593. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a38 pwszName=\Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll
  2594. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2595. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2596. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=61B08AF50BF6163BDE34EB0C9B6605297BA2441A
  2597. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2598. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2599. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll'
  2600. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2601. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2602. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  2603. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
  2604. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
  2605. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll
  2606. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  2607. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume5\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  2608. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a44 pwszName=\Device\HarddiskVolume5\Windows\System32\wbemcomn.dll
  2609. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2610. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2611. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=585E55607969886FF9DCECA6C86E3FD6D59F65D2
  2612. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2613. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2614. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\wbemcomn.dll'
  2615. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2616. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2617. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'bcrypt.dll'.
  2618. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'ws2_32.dll'.
  2619. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wbemcomn.dll) WinVerifyTrust
  2620. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wbemcomn.dll
  2621. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2622. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2623. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  2624. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2625. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2626. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2627. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2628. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  2629. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  2630. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  2631. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcrypt.dll
  2632. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2633. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2634. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2635. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll
  2636. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbemcomn.dll
  2637. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa4f390000 LB 0x00085000 C:\Windows\SYSTEM32\wbemcomn.dll [fFlags=0x0]
  2638. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbemcomn.dll
  2639. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa4ca20000 LB 0x00011000 C:\Windows\system32\wbem\wbemprox.dll [fFlags=0x0]
  2640. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\wbemprox.dll
  2641. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
  2642. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2643. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  2644. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4ca20000 'C:\Windows\system32\wbem\wbemprox.dll'
  2645. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a5c pwszName=\Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll
  2646. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2647. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2648. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2479751D59078C3499423233D67A94D93457E663
  2649. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2650. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2651. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll'
  2652. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2653. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2654. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  2655. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
  2656. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll
  2657. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2658. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2659. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2660. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2661. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2662. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll
  2663. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa4c6b0000 LB 0x00014000 C:\Windows\system32\wbem\wbemsvc.dll [fFlags=0x0]
  2664. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\wbemsvc.dll
  2665. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4c6b0000 'C:\Windows\system32\wbem\wbemsvc.dll'
  2666. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
  2667. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2668. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-localization-l1-2-0.dll'
  2669. 3088.3298: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
  2670. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2671. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa577d0000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
  2672. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ac4 pwszName=\Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll
  2673. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2674. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2675. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5D738E4890595C8890290239456518F354997BFD
  2676. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2677. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2678. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll'
  2679. 3088.3298: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2680. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2681. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'wbemcomn.dll'.
  2682. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
  2683. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll
  2684. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  2685. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume5\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  2686. 3088.3298: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbemcomn.dll
  2687. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2688. 3088.3298: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2689. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2690. 3088.3298: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll
  2691. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa4c6d0000 LB 0x000f1000 C:\Windows\system32\wbem\fastprox.dll [fFlags=0x0]
  2692. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wbem\fastprox.dll
  2693. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4c6d0000 'C:\Windows\system32\wbem\fastprox.dll'
  2694. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5a980000 'C:\Windows\System32\ADVAPI32.dll'
  2695. 3088.18f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2696. 3088.18f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2697. 3088.18f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2698. 3088.18f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
  2699. 3088.18f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2700. 3088.18f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2701. 3088.18f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2702. 3088.18f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2703. 3088.18f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2704. 3088.18f0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2705. 3088.18f0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2706. 3088.18f0: supR3HardenedDllNotificationCallback: load 00007ffa0d540000 LB 0x0037e000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
  2707. 3088.18f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2708. 3088.18f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa0d540000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  2709. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2710. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b78 pwszName=\Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll
  2711. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2712. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2713. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0B2433C408432C42F4E295613BAF5910A41852D3
  2714. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2715. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2716. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03113~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll'
  2717. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2718. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  2719. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
  2720. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'oleaut32.dll'.
  2721. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'ws2_32.dll'.
  2722. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'netsetupapi.dll'.
  2723. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'setupapi.dll'.
  2724. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'devrtl.dll'.
  2725. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll) WinVerifyTrust
  2726. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll
  2727. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devrtl.dll'...
  2728. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'devrtl.dll' -> '\Device\HarddiskVolume5\Windows\System32\devrtl.dll' [rcNtRedir=0xc0150008]
  2729. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b68 pwszName=\Device\HarddiskVolume5\Windows\System32\devrtl.dll
  2730. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  2731. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  2732. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9620C5F1DBCEC911C088602DD5FE1F576B1B6DD9
  2733. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2734. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2735. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0316~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\devrtl.dll'
  2736. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2737. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\devrtl.dll) WinVerifyTrust
  2738. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\devrtl.dll
  2739. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2740. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2741. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2742. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2743. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2744. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
  2745. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'cfgmgr32.dll'.
  2746. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'bcrypt.dll'.
  2747. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\setupapi.dll) WinVerifyTrust
  2748. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\setupapi.dll
  2749. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netsetupapi.dll'...
  2750. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'netsetupapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\netsetupapi.dll' [rcNtRedir=0xc0150008]
  2751. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  2752. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  2753. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcrypt.dll
  2754. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  2755. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  2756. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll
  2757. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2758. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2759. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2760. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2761. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2762. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2763. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2764. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  2765. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\NetSetupApi.dll) WinVerifyTrust
  2766. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\NetSetupApi.dll
  2767. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2768. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2769. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  2770. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2771. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2772. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2773. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2774. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2775. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2776. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  2777. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2778. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2779. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2780. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2781. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupShim.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2782. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll
  2783. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupApi.dll
  2784. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\devrtl.dll
  2785. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa4ecf0000 LB 0x00025000 C:\Windows\System32\NetSetupApi.dll [fFlags=0x0]
  2786. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupApi.dll
  2787. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa5a0f0000 LB 0x00475000 C:\Windows\System32\setupapi.dll [fFlags=0x0]
  2788. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\setupapi.dll
  2789. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa44610000 LB 0x00013000 C:\Windows\System32\DEVRTL.dll [fFlags=0x0]
  2790. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\devrtl.dll
  2791. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa23190000 LB 0x00081000 C:\Windows\System32\NetSetupShim.dll [fFlags=0x0]
  2792. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupShim.dll
  2793. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa23190000 'C:\Windows\System32\NetSetupShim.dll'
  2794. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2795. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2796. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2797. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  2798. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'nsi.dll'.
  2799. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'winnsi.dll'.
  2800. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\NetSetupEngine.dll) WinVerifyTrust
  2801. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\NetSetupEngine.dll
  2802. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winnsi.dll'...
  2803. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'winnsi.dll' -> '\Device\HarddiskVolume5\Windows\System32\winnsi.dll' [rcNtRedir=0xc0150008]
  2804. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2805. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2806. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  2807. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
  2808. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\winnsi.dll) WinVerifyTrust
  2809. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\winnsi.dll
  2810. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  2811. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume5\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  2812. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  2813. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume5\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  2814. 3088.2e44: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume5\Windows\System32\nsi.dll'.
  2815. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\nsi.dll)
  2816. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\nsi.dll
  2817. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2818. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2819. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2820. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2821. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\nsi.dll) WinVerifyTrust
  2822. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2823. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2824. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2825. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2826. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupEngine.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2827. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupEngine.dll
  2828. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winnsi.dll
  2829. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa5a000000 LB 0x00008000 C:\Windows\System32\NSI.dll [fFlags=0x0]
  2830. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\nsi.dll [avoiding WinVerifyTrust]
  2831. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa529d0000 LB 0x0000b000 C:\Windows\SYSTEM32\WINNSI.DLL [fFlags=0x0]
  2832. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winnsi.dll
  2833. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa4afe0000 LB 0x000cc000 C:\Windows\System32\NetSetupEngine.dll [fFlags=0x0]
  2834. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\NetSetupEngine.dll
  2835. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4afe0000 'C:\Windows\System32\NetSetupEngine.dll'
  2836. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2837. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2838. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\nsi.dll'
  2839. 3088.32e8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2840. 3088.32e8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2841. 3088.32e8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2842. 3088.32e8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  2843. 3088.32e8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  2844. 3088.32e8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
  2845. 3088.32e8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
  2846. 3088.32e8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2847. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2848. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2849. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2850. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2851. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2852. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2853. 3088.32e8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2854. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2855. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2856. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2857. 3088.32e8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2858. 3088.32e8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2859. 3088.32e8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2860. 3088.32e8: supR3HardenedDllNotificationCallback: load 00007ffa53c40000 LB 0x00010000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
  2861. 3088.32e8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2862. 3088.32e8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53c40000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
  2863. 3088.169c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2864. 3088.169c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2865. 3088.169c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2866. 3088.169c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2867. 3088.169c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
  2868. 3088.169c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2869. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2870. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2871. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2872. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2873. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2874. 3088.169c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2875. 3088.169c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2876. 3088.169c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2877. 3088.169c: supR3HardenedDllNotificationCallback: load 00007ffa53be0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
  2878. 3088.169c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2879. 3088.169c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53be0000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
  2880. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\shell32.dll
  2881. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2882. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa58ae0000 'C:\Windows\system32\Shell32.dll'
  2883. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2884. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2885. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2886. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2887. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2888. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
  2889. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
  2890. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2891. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  2892. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
  2893. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
  2894. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
  2895. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
  2896. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2897. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  2898. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  2899. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2900. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  2901. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
  2902. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
  2903. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\IPHLPAPI.DLL
  2904. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2905. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2906. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2907. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume5\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2908. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ws2_32.dll
  2909. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2910. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2911. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\setupapi.dll
  2912. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2913. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2914. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
  2915. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
  2916. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2917. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2918. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2919. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2920. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2921. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
  2922. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2923. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
  2924. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
  2925. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2926. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2927. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2928. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2929. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll
  2930. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2931. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2932. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2933. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2934. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
  2935. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  2936. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
  2937. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2938. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2939. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2940. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2941. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2942. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2943. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2944. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2945. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2946. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2947. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2948. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2949. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\setupapi.dll
  2950. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2951. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2952. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2953. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2954. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2955. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2956. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2957. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2958. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2959. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2960. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\IPHLPAPI.DLL
  2961. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa47c70000 LB 0x00067000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
  2962. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2963. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa01bc0000 LB 0x0085c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
  2964. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2965. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa56370000 LB 0x0003d000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
  2966. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\IPHLPAPI.DLL
  2967. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa02420000 LB 0x009e6000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
  2968. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2969. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa02420000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
  2970. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2971. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxC.dll
  2972. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2973. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa02e10000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
  2974. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2975. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2976. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2977. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa01bc0000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
  2978. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2979. 3088.680: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2980. 3088.680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2981. 3088.680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2982. 3088.680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2983. 3088.680: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
  2984. 3088.680: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2985. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2986. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2987. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2988. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2989. 3088.680: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2990. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2991. 3088.680: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2992. 3088.680: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2993. 3088.680: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2994. 3088.680: supR3HardenedDllNotificationCallback: load 00007ffa4bc00000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
  2995. 3088.680: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2996. 3088.680: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4bc00000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
  2997. 3088.320: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  2998. 3088.320: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2999. 3088.320: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3000. 3088.320: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  3001. 3088.320: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  3002. 3088.320: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
  3003. 3088.320: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3004. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3005. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3006. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  3007. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  3008. 3088.320: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3009. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3010. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3011. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3012. 3088.320: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3013. 3088.320: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3014. 3088.320: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3015. 3088.320: supR3HardenedDllNotificationCallback: load 00007ffa53bd0000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
  3016. 3088.320: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3017. 3088.320: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa53bd0000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
  3018. 3088.2de4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3019. 3088.2de4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3020. 3088.2de4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3021. 3088.2de4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3022. 3088.2de4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
  3023. 3088.2de4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3024. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3025. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3026. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3027. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3028. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3029. 3088.2de4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3030. 3088.2de4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3031. 3088.2de4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3032. 3088.2de4: supR3HardenedDllNotificationCallback: load 00007ffa535b0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
  3033. 3088.2de4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3034. 3088.2de4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa535b0000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
  3035. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3036. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3037. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  3038. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'devobj.dll'.
  3039. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'propsys.dll'.
  3040. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll) WinVerifyTrust
  3041. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3042. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
  3043. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume5\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
  3044. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3045. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3046. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3047. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'oleaut32.dll'.
  3048. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
  3049. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\propsys.dll) WinVerifyTrust
  3050. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\propsys.dll
  3051. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  3052. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume5\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  3053. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3054. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3055. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3056. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3057. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3058. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3059. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3060. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3061. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'cfgmgr32.dll'.
  3062. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\devobj.dll) WinVerifyTrust
  3063. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\devobj.dll
  3064. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3065. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3066. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  3067. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  3068. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\cfgmgr32.dll
  3069. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3070. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3071. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\devobj.dll
  3072. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\propsys.dll
  3073. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa56b90000 LB 0x00029000 C:\Windows\System32\DEVOBJ.dll [fFlags=0x0]
  3074. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\devobj.dll
  3075. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa51ef0000 LB 0x001a8000 C:\Windows\System32\PROPSYS.dll [fFlags=0x0]
  3076. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\propsys.dll
  3077. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa51cc0000 LB 0x00070000 C:\Windows\System32\MMDevApi.dll [fFlags=0x0]
  3078. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3079. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa51cc0000 'C:\Windows\System32\MMDevApi.dll'
  3080. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d34 pwszName=\Device\HarddiskVolume5\Windows\System32\dsound.dll
  3081. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  3082. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  3083. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B973A852091636F8493626192E69AE7AC7CBBB7F
  3084. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3085. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3086. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\dsound.dll'
  3087. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3088. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3089. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'winmm.dll'.
  3090. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\dsound.dll) WinVerifyTrust
  3091. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3092. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  3093. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  3094. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  3095. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3096. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3097. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3098. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3099. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa23680000 LB 0x00096000 C:\Windows\System32\dsound.dll [fFlags=0x0]
  3100. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3101. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3102. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3103. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa23680000 'C:\Windows\System32\dsound.dll'
  3104. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa23680000 'C:\Windows\System32\dsound.dll'
  3105. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3106. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3107. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa23680000 'C:\Windows\system32\dsound.dll'
  3108. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3109. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3110. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa51cc0000 'C:\Windows\System32\MMDEVAPI.DLL'
  3111. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3112. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3113. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  3114. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
  3115. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
  3116. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'mmdevapi.dll'.
  3117. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #58 'avrt.dll'.
  3118. 3088.2684: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\AudioSes.dll) WinVerifyTrust
  3119. 3088.2684: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\AudioSes.dll
  3120. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
  3121. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
  3122. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3123. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3124. 3088.2684: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\avrt.dll) WinVerifyTrust
  3125. 3088.2684: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\avrt.dll
  3126. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  3127. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  3128. 3088.2684: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3129. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3130. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume5\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3131. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3132. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3133. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  3134. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  3135. 3088.2684: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcp_win.dll
  3136. 3088.2684: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3137. 3088.2684: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\AudioSes.dll
  3138. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
  3139. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  3140. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'bcryptprimitives.dll'.
  3141. 3088.2684: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\WinTypes.dll)
  3142. 3088.2684: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\WinTypes.dll
  3143. 3088.2684: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\avrt.dll
  3144. 3088.2684: supR3HardenedDllNotificationCallback: load 00007ffa532b0000 LB 0x00153000 C:\Windows\SYSTEM32\wintypes.dll [fFlags=0x0]
  3145. 3088.2684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
  3146. 3088.2684: supR3HardenedDllNotificationCallback: load 00007ffa4bc50000 LB 0x0000a000 C:\Windows\SYSTEM32\AVRT.dll [fFlags=0x0]
  3147. 3088.2684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\avrt.dll
  3148. 3088.2684: supR3HardenedDllNotificationCallback: load 00007ffa3bcd0000 LB 0x00148000 C:\Windows\System32\AUDIOSES.DLL [fFlags=0x0]
  3149. 3088.2684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\AudioSes.dll
  3150. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3bcd0000 'C:\Windows\System32\AUDIOSES.DLL'
  3151. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  3152. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  3153. 3088.2684: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\bcryptprimitives.dll
  3154. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3155. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3156. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  3157. 3088.2684: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume5\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  3158. 3088.2684: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\combase.dll
  3159. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3160. 3088.2684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3161. 3088.2684: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\WinTypes.dll'
  3162. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3163. 3088.2684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  3164. 3088.2684: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ResourcePolicyClient.dll)
  3165. 3088.2684: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ResourcePolicyClient.dll
  3166. 3088.2684: supR3HardenedDllNotificationCallback: load 00007ffa557c0000 LB 0x00014000 C:\Windows\SYSTEM32\resourcepolicyclient.dll [fFlags=0x0]
  3167. 3088.2684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ResourcePolicyClient.dll [avoiding WinVerifyTrust]
  3168. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3169. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3170. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\rpcrt4.dll
  3171. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3172. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3173. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3174. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3175. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\ResourcePolicyClient.dll'
  3176. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  3177. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3178. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3179. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000f8c pwszName=\Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3180. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  3181. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  3182. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=22E5B934FBB9B8EED168F5BD0121AD902CCB797A
  3183. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3184. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3185. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\wdmaud.drv'
  3186. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3187. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3188. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'mmdevapi.dll'.
  3189. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'ksuser.dll'.
  3190. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'avrt.dll'.
  3191. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\wdmaud.drv) WinVerifyTrust
  3192. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3193. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
  3194. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
  3195. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\avrt.dll
  3196. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ksuser.dll'...
  3197. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'ksuser.dll' -> '\Device\HarddiskVolume5\Windows\System32\ksuser.dll' [rcNtRedir=0xc0150008]
  3198. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3199. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3200. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3201. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ksuser.dll) WinVerifyTrust
  3202. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ksuser.dll
  3203. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  3204. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  3205. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3206. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3207. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3208. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3209. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3210. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msvcrt.dll
  3211. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3212. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3213. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ksuser.dll
  3214. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa43a20000 LB 0x00009000 C:\Windows\SYSTEM32\ksuser.dll [fFlags=0x0]
  3215. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ksuser.dll
  3216. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa181b0000 LB 0x00044000 C:\Windows\System32\wdmaud.drv [fFlags=0x0]
  3217. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3218. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3219. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3220. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3221. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3222. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3223. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3224. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3225. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3226. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3227. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3228. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3229. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3230. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3231. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3232. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3233. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3234. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wdmaud.drv
  3235. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3236. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3237. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3238. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3239. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3240. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3241. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3242. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3243. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa181b0000 'C:\Windows\System32\wdmaud.drv'
  3244. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d1c pwszName=\Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3245. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  3246. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  3247. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DF9222E8F115E50DE05D7AD2D27BDC071ADD62AF
  3248. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3249. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3250. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\msacm32.drv'
  3251. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3252. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3253. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'mmdevapi.dll'.
  3254. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'msacm32.dll'.
  3255. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'winmmbase.dll'.
  3256. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msacm32.drv) WinVerifyTrust
  3257. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3258. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
  3259. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
  3260. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmmbase.dll
  3261. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msacm32.dll'...
  3262. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msacm32.dll' -> '\Device\HarddiskVolume5\Windows\System32\msacm32.dll' [rcNtRedir=0xc0150008]
  3263. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3264. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3265. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3266. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\msacm32.dll) WinVerifyTrust
  3267. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\msacm32.dll
  3268. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  3269. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  3270. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\MMDevAPI.dll
  3271. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3272. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3273. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3274. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3275. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3276. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3277. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.dll
  3278. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa2ebd0000 LB 0x0001c000 C:\Windows\SYSTEM32\MSACM32.dll [fFlags=0x0]
  3279. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.dll
  3280. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa3a220000 LB 0x0000d000 C:\Windows\System32\msacm32.drv [fFlags=0x0]
  3281. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3282. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3283. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3284. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3285. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3286. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3287. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3288. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3289. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3290. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3291. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3292. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3293. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3294. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3295. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3296. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3297. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3298. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msacm32.drv
  3299. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3300. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3301. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3302. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3303. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa3a220000 'C:\Windows\System32\msacm32.drv'
  3304. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d58 pwszName=\Device\HarddiskVolume5\Windows\System32\midimap.dll
  3305. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001904cc0
  3306. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001904cc0
  3307. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FE1B51D5EFA4634DA5F3478BB920BDCB24116539
  3308. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3309. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3310. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.17763.1.cat'; file='\Device\HarddiskVolume5\Windows\System32\midimap.dll'
  3311. 3088.2e44: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3312. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3313. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winmm.dll'.
  3314. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\midimap.dll) WinVerifyTrust
  3315. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3316. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  3317. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume5\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  3318. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\winmm.dll
  3319. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3320. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3321. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3322. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3323. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa39cf0000 LB 0x0000a000 C:\Windows\System32\midimap.dll [fFlags=0x0]
  3324. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3325. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa39cf0000 'C:\Windows\System32\midimap.dll'
  3326. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3327. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3328. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa39cf0000 'C:\Windows\System32\midimap.dll'
  3329. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3330. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3331. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa39cf0000 'C:\Windows\System32\midimap.dll'
  3332. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\midimap.dll
  3333. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  3334. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa39cf0000 'C:\Windows\System32\midimap.dll'
  3335. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3336. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3337. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3338. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dsound.dll
  3339. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3340. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa23680000 'C:\Windows\system32\dsound.dll'
  3341. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3342. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3343. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa52a70000 'C:\Windows\System32\winmm.dll'
  3344. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3345. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3346. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3347. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  3348. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'win32u.dll'.
  3349. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  3350. 3088.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'dwmapi.dll'.
  3351. 3088.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\d3d9.dll) WinVerifyTrust
  3352. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\d3d9.dll
  3353. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  3354. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume5\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  3355. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\dwmapi.dll
  3356. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  3357. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume5\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  3358. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  3359. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume5\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  3360. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3361. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume5\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3362. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3363. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3364. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\d3d9.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3365. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\d3d9.dll
  3366. 3088.2e44: supR3HardenedDllNotificationCallback: load 00007ffa4c040000 LB 0x0019e000 C:\Windows\system32\d3d9.dll [fFlags=0x0]
  3367. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\d3d9.dll
  3368. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa4c040000 'C:\Windows\system32\d3d9.dll'
  3369. 3088.2e44: \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll: Owner is administrators group.
  3370. 3088.2e44: \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll: VERR_CR_X509_CPV_NOT_VALID_AT_TIME for 0x5f5fc00c; retrying against current time: 0x5f68e2d6.
  3371. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3372. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3373. 3088.2e44: supHardenedWinVerifyImageByHandle: -> -23033 (\Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll) WinVerifyTrust
  3374. 3088.2e44: Error (rc=0):
  3375. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: rc=Unknown Status -23033 (0xffffa607) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll: Certificate is not valid (ValidTime=2020-09-14T19:10:45.000000000Z Validity=[2018-07-18T17:42:53.000000000Z...2019-07-18T17:42:53.000000000Z]): \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3376. 3088.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3377. 3088.2e44: Error (rc=0):
  3378. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll' (C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll): rcNt=0xc0000190
  3379. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll'
  3380. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -23033 (0xffffa607)) on \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3381. 3088.2e44: Error (rc=0):
  3382. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -23033 (0xffffa607) fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3383. 3088.2e44: Error (rc=0):
  3384. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll' (C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll): rcNt=0xc0000190
  3385. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll'
  3386. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa59fd0000 'C:\Windows\System32\gdi32.dll'
  3387. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status -23033 (0xffffa607)) on \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3388. 3088.2e44: Error (rc=0):
  3389. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cached rc=Unknown Status -23033 (0xffffa607) fImage=1 fProtect=0x2 fAccess=0x5 cHits=2 \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3390. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status -23033 (0xffffa607)) on \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3391. 3088.2e44: Error (rc=0):
  3392. 3088.2e44: supR3HardenedScreenImage/NtCreateSection: cached rc=Unknown Status -23033 (0xffffa607) fImage=1 fProtect=0x2 fAccess=0x5 cHits=3 \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_edf184f24a37bacd\nvldumdx.dll
  3393. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\msctf.dll
  3394. 3088.3298: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3395. 3088.3298: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa5abe0000 'C:\Windows\System32\MSCTF.dll'
  3396. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3397. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'rpcrt4.dll'.
  3398. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'coreuicomponents.dll'.
  3399. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'coremessaging.dll'.
  3400. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\TextInputFramework.dll)
  3401. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\TextInputFramework.dll
  3402. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3403. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'coremessaging.dll'.
  3404. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'shcore.dll'.
  3405. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\CoreUIComponents.dll)
  3406. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\CoreUIComponents.dll
  3407. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3408. 3088.3298: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
  3409. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll)
  3410. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll
  3411. 3088.3298: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume5\Windows\System32\ntmarta.dll)
  3412. 3088.3298: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume5\Windows\System32\ntmarta.dll
  3413. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa55e50000 LB 0x00031000 C:\Windows\SYSTEM32\ntmarta.dll [fFlags=0x0]
  3414. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
  3415. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa54e60000 LB 0x000e2000 C:\Windows\System32\CoreMessaging.dll [fFlags=0x0]
  3416. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll [avoiding WinVerifyTrust]
  3417. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa49910000 LB 0x00322000 C:\Windows\System32\CoreUIComponents.dll [fFlags=0x0]
  3418. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\CoreUIComponents.dll [avoiding WinVerifyTrust]
  3419. 3088.3298: supR3HardenedDllNotificationCallback: load 00007ffa487c0000 LB 0x00095000 C:\Windows\System32\TextInputFramework.dll [fFlags=0x0]
  3420. 3088.3298: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\TextInputFramework.dll [avoiding WinVerifyTrust]
  3421. 3088.2e44: KiUserExceptionDispatcher: 0xc0000005 (0000000000000000, 0000000000000000) @ 00007ffa024af47c (flags=0x0)
  3422. rax=0000000000000020 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000020
  3423. rsi=0000000000000000 rdi=0000000005e45080 r8 =0000000000000016 r9 =0000000000000016
  3424. r10=00000000094bf3e8 r11=000000000652ebcb r12=0000000005e45080 r13=000000000bc40140
  3425. r14=000000000bc60000 r15=0000000000000000 P1=000000001e0a4040 P2=00000000094bf1e0
  3426. rip=00007ffa024af47c rsp=00000000094bf310 rbp=0000000000000016 ctxflags=0010005f
  3427. cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b eflags=00010246 mxcrx=00001fa0
  3428. P3=0000000000000000 P4=00000000094bedb0 P5=0000000000000000 P6=0000001000000000
  3429. dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  3430. dr6=0000000000000000 dr7=0000000000000000 vcr=00000000094bf1f0 dcr=0000000000000000
  3431. lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
  3432. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3433. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3434. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3435. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3436. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  3437. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume5\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  3438. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\SHCore.dll
  3439. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  3440. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume5\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  3441. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  3442. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3443. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3444. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  3445. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume5\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  3446. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  3447. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coreuicomponents.dll'...
  3448. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' -> '\Device\HarddiskVolume5\Windows\System32\coreuicomponents.dll' [rcNtRedir=0xc0150008]
  3449. 3088.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\CoreUIComponents.dll [lacks WinVerifyTrust]
  3450. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3451. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume5\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3452. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3453. 3088.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume5\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3454. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3455. 3088.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume5\Windows\System32\wintrust.dll
  3456. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3457. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57770000 'C:\Windows\System32\WINTRUST.DLL'
  3458. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\CRYPT32.dll'
  3459. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3460. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\ntmarta.dll'
  3461. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3462. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3463. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\CoreMessaging.dll'
  3464. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3465. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3466. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\CoreUIComponents.dll'
  3467. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa561d0000 'C:\Windows\system32\rsaenh.dll'
  3468. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa57a70000 'C:\Windows\System32\crypt32.dll'
  3469. 3088.2e44: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume5\Windows\System32\TextInputFramework.dll'
  3470. 3088.2e44: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-kernel32-errorhandling-l1-1-0.dll) -> 0x0, fPresent=1
  3471. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-kernel32-errorhandling-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3472. 3088.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffa588c0000 'ext-ms-win-kernel32-errorhandling-l1-1-0.dll'
  3473. 21dc.32b0: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1226618 ms, the end);
  3474. 2cc0.1340: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1227014 ms, the end);
  3475.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!