API tools faq
paste
joeybuddy96

unmanageable 02

joeybuddy96
Apr 23rd, 2020
48
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 215.96 KB | None | 0 0
raw download clone embed print report
  1. 2bf0.7b98: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000088 g_uNtVerCombined=0xa047bb00
  2. 2bf0.7b98: \SystemRoot\System32\ntdll.dll:
  3. 2bf0.7b98: CreationTime: 2020-04-23T01:00:41.383162400Z
  4. 2bf0.7b98: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  5. 2bf0.7b98: ChangeTime: 2020-04-23T01:09:23.871662000Z
  6. 2bf0.7b98: FileAttributes: 0x20
  7. 2bf0.7b98: Size: 0x1e8460
  8. 2bf0.7b98: NT Headers: 0xd8
  9. 2bf0.7b98: Timestamp: 0xb29ecf52
  10. 2bf0.7b98: Machine: 0x8664 - amd64
  11. 2bf0.7b98: Timestamp: 0xb29ecf52
  12. 2bf0.7b98: Image Version: 10.0
  13. 2bf0.7b98: SizeOfImage: 0x1f0000 (2031616)
  14. 2bf0.7b98: Resource Dir: 0x17f000 LB 0x6f310
  15. 2bf0.7b98: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 2bf0.7b98: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 2bf0.7b98: ProductName: Microsoft® Windows® Operating System
  18. 2bf0.7b98: ProductVersion: 10.0.18362.815
  19. 2bf0.7b98: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  20. 2bf0.7b98: FileDescription: NT Layer DLL
  21. 2bf0.7b98: \SystemRoot\System32\kernel32.dll:
  22. 2bf0.7b98: CreationTime: 2020-04-15T06:24:41.285620100Z
  23. 2bf0.7b98: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  24. 2bf0.7b98: ChangeTime: 2020-04-23T01:01:11.952622000Z
  25. 2bf0.7b98: FileAttributes: 0x20
  26. 2bf0.7b98: Size: 0xb0498
  27. 2bf0.7b98: NT Headers: 0xe8
  28. 2bf0.7b98: Timestamp: 0x21b07e83
  29. 2bf0.7b98: Machine: 0x8664 - amd64
  30. 2bf0.7b98: Timestamp: 0x21b07e83
  31. 2bf0.7b98: Image Version: 10.0
  32. 2bf0.7b98: SizeOfImage: 0xb2000 (729088)
  33. 2bf0.7b98: Resource Dir: 0xb0000 LB 0x520
  34. 2bf0.7b98: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 2bf0.7b98: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 2bf0.7b98: ProductName: Microsoft® Windows® Operating System
  37. 2bf0.7b98: ProductVersion: 10.0.18362.778
  38. 2bf0.7b98: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  39. 2bf0.7b98: FileDescription: Windows NT BASE API Client DLL
  40. 2bf0.7b98: \SystemRoot\System32\KernelBase.dll:
  41. 2bf0.7b98: CreationTime: 2020-04-23T01:00:41.758247200Z
  42. 2bf0.7b98: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  43. 2bf0.7b98: ChangeTime: 2020-04-23T01:09:23.809157500Z
  44. 2bf0.7b98: FileAttributes: 0x20
  45. 2bf0.7b98: Size: 0x2a4068
  46. 2bf0.7b98: NT Headers: 0xf8
  47. 2bf0.7b98: Timestamp: 0xb89efff3
  48. 2bf0.7b98: Machine: 0x8664 - amd64
  49. 2bf0.7b98: Timestamp: 0xb89efff3
  50. 2bf0.7b98: Image Version: 10.0
  51. 2bf0.7b98: SizeOfImage: 0x2a4000 (2768896)
  52. 2bf0.7b98: Resource Dir: 0x27e000 LB 0x548
  53. 2bf0.7b98: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 2bf0.7b98: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  55. 2bf0.7b98: ProductName: Microsoft® Windows® Operating System
  56. 2bf0.7b98: ProductVersion: 10.0.18362.815
  57. 2bf0.7b98: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  58. 2bf0.7b98: FileDescription: Windows NT BASE API Client DLL
  59. 2bf0.7b98: \SystemRoot\System32\apisetschema.dll:
  60. 2bf0.7b98: CreationTime: 2019-03-19T04:43:54.837151500Z
  61. 2bf0.7b98: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  62. 2bf0.7b98: ChangeTime: 2020-04-23T01:01:11.931617700Z
  63. 2bf0.7b98: FileAttributes: 0x20
  64. 2bf0.7b98: Size: 0x1d028
  65. 2bf0.7b98: NT Headers: 0xc8
  66. 2bf0.7b98: Timestamp: 0xd6ced080
  67. 2bf0.7b98: Machine: 0x8664 - amd64
  68. 2bf0.7b98: Timestamp: 0xd6ced080
  69. 2bf0.7b98: Image Version: 10.0
  70. 2bf0.7b98: SizeOfImage: 0x1e000 (122880)
  71. 2bf0.7b98: Resource Dir: 0x1d000 LB 0x408
  72. 2bf0.7b98: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 2bf0.7b98: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  74. 2bf0.7b98: ProductName: Microsoft® Windows® Operating System
  75. 2bf0.7b98: ProductVersion: 10.0.18362.1
  76. 2bf0.7b98: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  77. 2bf0.7b98: FileDescription: ApiSet Schema DLL
  78. 2bf0.7b98: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 2bf0.7b98: supR3HardenedWinFindAdversaries: 0x0
  80. 2bf0.7b98: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  81. 2bf0.7b98: Calling main()
  82. 2bf0.7b98: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  83. 2bf0.7b98: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  84. 2bf0.7b98: SUPR3HardenedMain: Respawn #1
  85. 2bf0.7b98: System32: \Device\HarddiskVolume4\Windows\System32
  86. 2bf0.7b98: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  87. 2bf0.7b98: KnownDllPath: C:\WINDOWS\System32
  88. 2bf0.7b98: supR3HardenedWinInit: Performing a limited self purification...
  89. 2bf0.7b98: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
  90. 2bf0.7b98: *0000000000000000-0000000000b0ffff 0x0001/0x0000 0x0000000
  91. 2bf0.7b98: *0000000000b10000-0000000000b1ffff 0x0004/0x0004 0x0040000
  92. 2bf0.7b98: 0000000000b20000-0000000000b2ffff 0x0001/0x0000 0x0000000
  93. 2bf0.7b98: *0000000000b30000-0000000000b4afff 0x0002/0x0002 0x0040000
  94. 2bf0.7b98: 0000000000b4b000-0000000000b4ffff 0x0001/0x0000 0x0000000
  95. 2bf0.7b98: *0000000000b50000-0000000000b53fff 0x0002/0x0002 0x0040000
  96. 2bf0.7b98: 0000000000b54000-0000000000b5ffff 0x0001/0x0000 0x0000000
  97. 2bf0.7b98: *0000000000b60000-0000000000b61fff 0x0004/0x0004 0x0020000
  98. 2bf0.7b98: 0000000000b62000-0000000000bfffff 0x0001/0x0000 0x0000000
  99. 2bf0.7b98: *0000000000c00000-0000000000c9bfff 0x0000/0x0004 0x0020000
  100. 2bf0.7b98: 0000000000c9c000-0000000000c9efff 0x0004/0x0004 0x0020000
  101. 2bf0.7b98: 0000000000c9f000-0000000000dfffff 0x0000/0x0004 0x0020000
  102. 2bf0.7b98: *0000000000e00000-0000000000eb8fff 0x0000/0x0004 0x0020000
  103. 2bf0.7b98: 0000000000eb9000-0000000000ebbfff 0x0104/0x0004 0x0020000
  104. 2bf0.7b98: 0000000000ebc000-0000000000efffff 0x0004/0x0004 0x0020000
  105. 2bf0.7b98: *0000000000f00000-0000000000fc6fff 0x0002/0x0002 0x0040000
  106. 2bf0.7b98: 0000000000fc7000-000000000101ffff 0x0001/0x0000 0x0000000
  107. 2bf0.7b98: *0000000001020000-0000000001026fff 0x0004/0x0004 0x0020000
  108. 2bf0.7b98: 0000000001027000-000000000111ffff 0x0000/0x0004 0x0020000
  109. 2bf0.7b98: *0000000001120000-000000000113cfff 0x0004/0x0004 0x0020000
  110. 2bf0.7b98: 000000000113d000-000000000121ffff 0x0000/0x0004 0x0020000
  111. 2bf0.7b98: 0000000001220000-000000000129ffff 0x0001/0x0000 0x0000000
  112. 2bf0.7b98: *00000000012a0000-00000000012aefff 0x0004/0x0004 0x0020000
  113. 2bf0.7b98: 00000000012af000-00000000012affff 0x0000/0x0004 0x0020000
  114. 2bf0.7b98: *00000000012b0000-00000000012b1fff 0x0000/0x0004 0x0020000
  115. 2bf0.7b98: 00000000012b2000-00000000014a2fff 0x0004/0x0004 0x0020000
  116. 2bf0.7b98: 00000000014a3000-00000000014a3fff 0x0000/0x0004 0x0020000
  117. 2bf0.7b98: 00000000014a4000-00000000014affff 0x0001/0x0000 0x0000000
  118. 2bf0.7b98: *00000000014b0000-00000000014b1fff 0x0004/0x0004 0x0020000
  119. 2bf0.7b98: 00000000014b2000-0000000001634fff 0x0000/0x0004 0x0020000
  120. 2bf0.7b98: 0000000001635000-000000007ffdffff 0x0001/0x0000 0x0000000
  121. 2bf0.7b98: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  122. 2bf0.7b98: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  123. 2bf0.7b98: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  124. 2bf0.7b98: 000000007ffe4000-00007ff421b0ffff 0x0001/0x0000 0x0000000
  125. 2bf0.7b98: *00007ff421b10000-00007ff421b14fff 0x0002/0x0002 0x0040000
  126. 2bf0.7b98: 00007ff421b15000-00007ff421c0ffff 0x0000/0x0002 0x0040000
  127. 2bf0.7b98: *00007ff421c10000-00007ff521c2ffff 0x0000/0x0004 0x0020000
  128. 2bf0.7b98: *00007ff521c30000-00007ff523c2ffff 0x0000/0x0004 0x0020000
  129. 2bf0.7b98: 00007ff523c30000-00007ff523c30fff 0x0004/0x0004 0x0020000
  130. 2bf0.7b98: 00007ff523c31000-00007ff523c3ffff 0x0001/0x0000 0x0000000
  131. 2bf0.7b98: *00007ff523c40000-00007ff523c40fff 0x0002/0x0002 0x0040000
  132. 2bf0.7b98: 00007ff523c41000-00007ff523c4ffff 0x0001/0x0000 0x0000000
  133. 2bf0.7b98: *00007ff523c50000-00007ff523c72fff 0x0002/0x0002 0x0040000
  134. 2bf0.7b98: 00007ff523c73000-00007ff617cbffff 0x0001/0x0000 0x0000000
  135. 2bf0.7b98: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  136. 2bf0.7b98: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  137. 2bf0.7b98: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  138. 2bf0.7b98: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  139. 2bf0.7b98: 00007ff617d7f000-00007ff617d81fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  140. 2bf0.7b98: 00007ff617d82000-00007ff617d84fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  141. 2bf0.7b98: 00007ff617d85000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  142. 2bf0.7b98: 00007ff617d88000-00007ff617d88fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  143. 2bf0.7b98: 00007ff617d89000-00007ff617d8afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  144. 2bf0.7b98: 00007ff617d8b000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  145. 2bf0.7b98: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  146. 2bf0.7b98: 00007ff617dd5000-00007ffbb79effff 0x0001/0x0000 0x0000000
  147. 2bf0.7b98: *00007ffbb79f0000-00007ffbb79f0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  148. 2bf0.7b98: 00007ffbb79f1000-00007ffbb7af5fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  149. 2bf0.7b98: 00007ffbb7af6000-00007ffbb7c58fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  150. 2bf0.7b98: 00007ffbb7c59000-00007ffbb7c5cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  151. 2bf0.7b98: 00007ffbb7c5d000-00007ffbb7c5dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  152. 2bf0.7b98: 00007ffbb7c5e000-00007ffbb7c93fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  153. 2bf0.7b98: 00007ffbb7c94000-00007ffbb86dffff 0x0001/0x0000 0x0000000
  154. 2bf0.7b98: *00007ffbb86e0000-00007ffbb86e0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  155. 2bf0.7b98: 00007ffbb86e1000-00007ffbb8755fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  156. 2bf0.7b98: 00007ffbb8756000-00007ffbb8787fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  157. 2bf0.7b98: 00007ffbb8788000-00007ffbb8788fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  158. 2bf0.7b98: 00007ffbb8789000-00007ffbb8789fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  159. 2bf0.7b98: 00007ffbb878a000-00007ffbb8791fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  160. 2bf0.7b98: 00007ffbb8792000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  161. 2bf0.7b98: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  162. 2bf0.7b98: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  163. 2bf0.7b98: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  164. 2bf0.7b98: 00007ffbba67f000-00007ffbba67ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  165. 2bf0.7b98: 00007ffbba680000-00007ffbba681fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  166. 2bf0.7b98: 00007ffbba682000-00007ffbba68afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  167. 2bf0.7b98: 00007ffbba68b000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  168. 2bf0.7b98: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  169. 2bf0.7b98: kernel32.dll: timestamp 0x21b07e83 (rc=VINF_SUCCESS)
  170. 2bf0.7b98: kernelbase.dll: timestamp 0xb89efff3 (rc=VINF_SUCCESS)
  171. 2bf0.7b98: VBoxHeadless.exe: timestamp 0x5d9f7c37 (rc=VINF_SUCCESS)
  172. 2bf0.7b98: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  173. 2bf0.7b98: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  174. 2bf0.7b98: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0
  175. 2bf0.7b98: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  176. 2bf0.7b98: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  177. 2bf0.7b98: supR3HardNtEnableThreadCreationEx:
  178. 2bf0.7b98: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  179. 2bf0.7b98: supR3HardenedWinDoReSpawn(1): New child 7944.787c [kernel32].
  180. 2bf0.7b98: supR3HardNtChildGatherData: PebBaseAddress=00000000008bb000 cbPeb=0x388
  181. 2bf0.7b98: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbba520000 uNtDllChildAddr=00007ffbba520000
  182. 2bf0.7b98: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbba591770
  183. 2bf0.7b98: supR3HardenedWinSetupChildInit: Start child.
  184. 2bf0.7b98: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  185. 2bf0.7b98: supR3HardNtChildPurify: Startup delay kludge #1/0: 263 ms, 30 sleeps
  186. 2bf0.7b98: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  187. 2bf0.7b98: *0000000000000000-00000000007dffff 0x0001/0x0000 0x0000000
  188. 2bf0.7b98: *00000000007e0000-00000000007fffff 0x0004/0x0004 0x0020000
  189. 2bf0.7b98: *0000000000800000-00000000008bafff 0x0000/0x0004 0x0020000
  190. 2bf0.7b98: 00000000008bb000-00000000008bdfff 0x0004/0x0004 0x0020000
  191. 2bf0.7b98: 00000000008be000-00000000009fffff 0x0000/0x0004 0x0020000
  192. 2bf0.7b98: *0000000000a00000-0000000000a1afff 0x0002/0x0002 0x0040000
  193. 2bf0.7b98: 0000000000a1b000-0000000000a1ffff 0x0001/0x0000 0x0000000
  194. 2bf0.7b98: *0000000000a20000-0000000000b1afff 0x0000/0x0004 0x0020000
  195. 2bf0.7b98: 0000000000b1b000-0000000000b1dfff 0x0104/0x0004 0x0020000
  196. 2bf0.7b98: 0000000000b1e000-0000000000b1ffff 0x0004/0x0004 0x0020000
  197. 2bf0.7b98: *0000000000b20000-0000000000b23fff 0x0002/0x0002 0x0040000
  198. 2bf0.7b98: 0000000000b24000-0000000000b2ffff 0x0001/0x0000 0x0000000
  199. 2bf0.7b98: *0000000000b30000-0000000000b31fff 0x0004/0x0004 0x0020000
  200. 2bf0.7b98: 0000000000b32000-000000007ffdffff 0x0001/0x0000 0x0000000
  201. 2bf0.7b98: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  202. 2bf0.7b98: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  203. 2bf0.7b98: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  204. 2bf0.7b98: 000000007ffe4000-00007ff50a28ffff 0x0001/0x0000 0x0000000
  205. 2bf0.7b98: *00007ff50a290000-00007ff50a290fff 0x0002/0x0002 0x0040000
  206. 2bf0.7b98: 00007ff50a291000-00007ff50a29ffff 0x0001/0x0000 0x0000000
  207. 2bf0.7b98: *00007ff50a2a0000-00007ff50a2c2fff 0x0002/0x0002 0x0040000
  208. 2bf0.7b98: 00007ff50a2c3000-00007ff617cbffff 0x0001/0x0000 0x0000000
  209. 2bf0.7b98: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  210. 2bf0.7b98: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  211. 2bf0.7b98: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  212. 2bf0.7b98: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  213. 2bf0.7b98: 00007ff617d7f000-00007ff617d7ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  214. 2bf0.7b98: 00007ff617d80000-00007ff617d80fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  215. 2bf0.7b98: 00007ff617d81000-00007ff617d85fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  216. 2bf0.7b98: 00007ff617d86000-00007ff617d86fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  217. 2bf0.7b98: 00007ff617d87000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  218. 2bf0.7b98: 00007ff617d88000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  219. 2bf0.7b98: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  220. 2bf0.7b98: 00007ff617dd5000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  221. 2bf0.7b98: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  222. 2bf0.7b98: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  223. 2bf0.7b98: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  224. 2bf0.7b98: 00007ffbba67f000-00007ffbba68afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  225. 2bf0.7b98: 00007ffbba68b000-00007ffbba699fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  226. 2bf0.7b98: 00007ffbba69a000-00007ffbba69afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  227. 2bf0.7b98: 00007ffbba69b000-00007ffbba69dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  228. 2bf0.7b98: 00007ffbba69e000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  229. 2bf0.7b98: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  230. 2bf0.7b98: supR3HardNtChildPurify: Done after 274 ms and 0 fixes (loop #0).
  231. 7944.787c: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000008 g_uNtVerCombined=0xa047bb00
  232. 7944.787c: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbba520000 g_uNtVerCombined=0xa047bb00
  233. 7944.787c: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
  234. 7944.787c: New simple heap: #1 0000000000c40000 LB 0x400000 (for 2031616 allocation)
  235. 2bf0.7b98: supR3HardNtEnableThreadCreationEx:
  236. 7944.787c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  237. 7944.787c: System32: \Device\HarddiskVolume4\Windows\System32
  238. 7944.787c: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  239. 7944.787c: KnownDllPath: C:\WINDOWS\System32
  240. 7944.787c: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  241. 7944.787c: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  242. 7944.787c: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  243. 7944.787c: Registered Dll notification callback with NTDLL.
  244. 7944.787c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
  245. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  246. 7944.787c: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  247. 7944.787c: supR3HardenedDllNotificationCallback: load 00007ffbb79f0000 LB 0x002a4000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  248. 7944.787c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
  249. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  250. 7944.787c: supR3HardenedDllNotificationCallback: load 00007ffbb86e0000 LB 0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  251. 7944.787c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  252. 7944.787c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  253. 7944.787c: supR3HardenedDllNotificationCallback: load 00007ff617cc0000 LB 0x00115000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe [fFlags=0x0]
  254. 7944.787c: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  255. 7944.787c: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  256. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  257. 7944.787c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  258. 2bf0.7b98: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 169 ms.
  259. 7944.787c: \SystemRoot\System32\ntdll.dll:
  260. 7944.787c: CreationTime: 2020-04-23T01:00:41.383162400Z
  261. 7944.787c: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  262. 7944.787c: ChangeTime: 2020-04-23T01:09:23.871662000Z
  263. 7944.787c: FileAttributes: 0x20
  264. 7944.787c: Size: 0x1e8460
  265. 7944.787c: NT Headers: 0xd8
  266. 7944.787c: Timestamp: 0xb29ecf52
  267. 7944.787c: Machine: 0x8664 - amd64
  268. 7944.787c: Timestamp: 0xb29ecf52
  269. 7944.787c: Image Version: 10.0
  270. 7944.787c: SizeOfImage: 0x1f0000 (2031616)
  271. 7944.787c: Resource Dir: 0x17f000 LB 0x6f310
  272. 7944.787c: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  273. 7944.787c: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  274. 7944.787c: ProductName: Microsoft® Windows® Operating System
  275. 7944.787c: ProductVersion: 10.0.18362.815
  276. 7944.787c: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  277. 7944.787c: FileDescription: NT Layer DLL
  278. 7944.787c: \SystemRoot\System32\kernel32.dll:
  279. 7944.787c: CreationTime: 2020-04-15T06:24:41.285620100Z
  280. 7944.787c: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  281. 7944.787c: ChangeTime: 2020-04-23T01:01:11.952622000Z
  282. 7944.787c: FileAttributes: 0x20
  283. 7944.787c: Size: 0xb0498
  284. 7944.787c: NT Headers: 0xe8
  285. 7944.787c: Timestamp: 0x21b07e83
  286. 7944.787c: Machine: 0x8664 - amd64
  287. 7944.787c: Timestamp: 0x21b07e83
  288. 7944.787c: Image Version: 10.0
  289. 7944.787c: SizeOfImage: 0xb2000 (729088)
  290. 7944.787c: Resource Dir: 0xb0000 LB 0x520
  291. 7944.787c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  292. 7944.787c: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  293. 7944.787c: ProductName: Microsoft® Windows® Operating System
  294. 7944.787c: ProductVersion: 10.0.18362.778
  295. 7944.787c: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  296. 7944.787c: FileDescription: Windows NT BASE API Client DLL
  297. 7944.787c: \SystemRoot\System32\KernelBase.dll:
  298. 7944.787c: CreationTime: 2020-04-23T01:00:41.758247200Z
  299. 7944.787c: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  300. 7944.787c: ChangeTime: 2020-04-23T01:09:23.809157500Z
  301. 7944.787c: FileAttributes: 0x20
  302. 7944.787c: Size: 0x2a4068
  303. 7944.787c: NT Headers: 0xf8
  304. 7944.787c: Timestamp: 0xb89efff3
  305. 7944.787c: Machine: 0x8664 - amd64
  306. 7944.787c: Timestamp: 0xb89efff3
  307. 7944.787c: Image Version: 10.0
  308. 7944.787c: SizeOfImage: 0x2a4000 (2768896)
  309. 7944.787c: Resource Dir: 0x27e000 LB 0x548
  310. 7944.787c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  311. 7944.787c: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  312. 7944.787c: ProductName: Microsoft® Windows® Operating System
  313. 7944.787c: ProductVersion: 10.0.18362.815
  314. 7944.787c: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  315. 7944.787c: FileDescription: Windows NT BASE API Client DLL
  316. 7944.787c: \SystemRoot\System32\apisetschema.dll:
  317. 7944.787c: CreationTime: 2019-03-19T04:43:54.837151500Z
  318. 7944.787c: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  319. 7944.787c: ChangeTime: 2020-04-23T01:01:11.931617700Z
  320. 7944.787c: FileAttributes: 0x20
  321. 7944.787c: Size: 0x1d028
  322. 7944.787c: NT Headers: 0xc8
  323. 7944.787c: Timestamp: 0xd6ced080
  324. 7944.787c: Machine: 0x8664 - amd64
  325. 7944.787c: Timestamp: 0xd6ced080
  326. 7944.787c: Image Version: 10.0
  327. 7944.787c: SizeOfImage: 0x1e000 (122880)
  328. 7944.787c: Resource Dir: 0x1d000 LB 0x408
  329. 7944.787c: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  330. 7944.787c: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  331. 7944.787c: ProductName: Microsoft® Windows® Operating System
  332. 7944.787c: ProductVersion: 10.0.18362.1
  333. 7944.787c: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  334. 7944.787c: FileDescription: ApiSet Schema DLL
  335. 7944.787c: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  336. 7944.787c: supR3HardenedWinFindAdversaries: 0x0
  337. 7944.787c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  338. 7944.787c: Calling main()
  339. 7944.787c: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  340. 7944.787c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  341. 7944.787c: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  342. 7944.787c: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  343. 7944.787c: SUPR3HardenedMain: Respawn #2
  344. 7944.787c: supR3HardNtEnableThreadCreationEx:
  345. 7944.787c: supR3HardenedDllNotificationCallback: load 00007ffbb9860000 LB 0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  346. 7944.787c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll)
  347. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  348. 7944.787c: supR3HardenedDllNotificationCallback: load 00007ffbb9740000 LB 0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  349. 7944.787c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  350. 7944.787c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\sechost.dll)
  351. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\sechost.dll
  352. 7944.787c: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  353. 7944.787c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ntdll.dll)
  354. 7944.787c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  355. 7944.787c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  356. 7944.787c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  357. 7944.787c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  358. 7944.787c: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  359. 7944.787c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbba520000 'C:\WINDOWS\System32\ntdll.dll'
  360. 7944.787c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  361. 7944.787c: supR3HardenedWinDoReSpawn(2): New child 7744.75ec [kernel32].
  362. 7944.787c: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
  363. 7944.787c: supR3HardNtChildGatherData: PebBaseAddress=0000000001033000 cbPeb=0x388
  364. 7944.787c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbba520000 uNtDllChildAddr=00007ffbba520000
  365. 7944.787c: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbba591770
  366. 7944.787c: supR3HardenedWinSetupChildInit: Start child.
  367. 7944.787c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  368. 7944.787c: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 30 sleeps
  369. 7944.787c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  370. 7944.787c: *0000000000000000-0000000000e7ffff 0x0001/0x0000 0x0000000
  371. 7944.787c: *0000000000e80000-0000000000e9ffff 0x0004/0x0004 0x0020000
  372. 7944.787c: *0000000000ea0000-0000000000ebafff 0x0002/0x0002 0x0040000
  373. 7944.787c: 0000000000ebb000-0000000000ebffff 0x0001/0x0000 0x0000000
  374. 7944.787c: *0000000000ec0000-0000000000fbafff 0x0000/0x0004 0x0020000
  375. 7944.787c: 0000000000fbb000-0000000000fbdfff 0x0104/0x0004 0x0020000
  376. 7944.787c: 0000000000fbe000-0000000000fbffff 0x0004/0x0004 0x0020000
  377. 7944.787c: *0000000000fc0000-0000000000fc3fff 0x0002/0x0002 0x0040000
  378. 7944.787c: 0000000000fc4000-0000000000fcffff 0x0001/0x0000 0x0000000
  379. 7944.787c: *0000000000fd0000-0000000000fd1fff 0x0004/0x0004 0x0020000
  380. 7944.787c: 0000000000fd2000-0000000000ffffff 0x0001/0x0000 0x0000000
  381. 7944.787c: *0000000001000000-0000000001032fff 0x0000/0x0004 0x0020000
  382. 7944.787c: 0000000001033000-0000000001035fff 0x0004/0x0004 0x0020000
  383. 7944.787c: 0000000001036000-00000000011fffff 0x0000/0x0004 0x0020000
  384. 7944.787c: 0000000001200000-000000007ffdffff 0x0001/0x0000 0x0000000
  385. 7944.787c: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  386. 7944.787c: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  387. 7944.787c: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  388. 7944.787c: 000000007ffe4000-00007ff58f77ffff 0x0001/0x0000 0x0000000
  389. 7944.787c: *00007ff58f780000-00007ff58f780fff 0x0002/0x0002 0x0040000
  390. 7944.787c: 00007ff58f781000-00007ff58f78ffff 0x0001/0x0000 0x0000000
  391. 7944.787c: *00007ff58f790000-00007ff58f7b2fff 0x0002/0x0002 0x0040000
  392. 7944.787c: 00007ff58f7b3000-00007ff617cbffff 0x0001/0x0000 0x0000000
  393. 7944.787c: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  394. 7944.787c: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  395. 7944.787c: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  396. 7944.787c: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  397. 7944.787c: 00007ff617d7f000-00007ff617d7ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  398. 7944.787c: 00007ff617d80000-00007ff617d80fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  399. 7944.787c: 00007ff617d81000-00007ff617d85fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  400. 7944.787c: 00007ff617d86000-00007ff617d86fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  401. 7944.787c: 00007ff617d87000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  402. 7944.787c: 00007ff617d88000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  403. 7944.787c: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  404. 7944.787c: 00007ff617dd5000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  405. 7944.787c: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  406. 7944.787c: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  407. 7944.787c: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  408. 7944.787c: 00007ffbba67f000-00007ffbba68afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  409. 7944.787c: 00007ffbba68b000-00007ffbba699fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  410. 7944.787c: 00007ffbba69a000-00007ffbba69afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  411. 7944.787c: 00007ffbba69b000-00007ffbba69dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  412. 7944.787c: 00007ffbba69e000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  413. 7944.787c: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  414. 7944.787c: VBoxHeadless.exe: timestamp 0x5d9f7c37 (rc=VINF_SUCCESS)
  415. 7944.787c: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  416. 7944.787c: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  417. 7944.787c: supR3HardNtChildPurify: Done after 340 ms and 0 fixes (loop #0).
  418. 7944.787c: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000c40000 LB 0x400000)
  419. 7944.787c: supR3HardNtEnableThreadCreationEx:
  420. 7744.75ec: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000008 g_uNtVerCombined=0xa047bb00
  421. 7744.75ec: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbba520000 g_uNtVerCombined=0xa047bb00
  422. 7744.75ec: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
  423. 7744.75ec: New simple heap: #1 0000000001300000 LB 0x400000 (for 2031616 allocation)
  424. 7744.75ec: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  425. 7744.75ec: System32: \Device\HarddiskVolume4\Windows\System32
  426. 7744.75ec: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  427. 7744.75ec: KnownDllPath: C:\WINDOWS\System32
  428. 7744.75ec: supR3HardenedVmProcessInit: Opening vboxdrv...
  429. 7744.75ec: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  430. 7744.75ec: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  431. 7744.75ec: Registered Dll notification callback with NTDLL.
  432. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
  433. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  434. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  435. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb79f0000 LB 0x002a4000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  436. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
  437. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  438. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb86e0000 LB 0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  439. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  440. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  441. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ff617cc0000 LB 0x00115000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe [fFlags=0x0]
  442. 7744.75ec: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  443. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  444. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  445. 7744.75ec: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  446. 7944.787c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 263 ms.
  447. 7744.75ec: \SystemRoot\System32\ntdll.dll:
  448. 7744.75ec: CreationTime: 2020-04-23T01:00:41.383162400Z
  449. 7744.75ec: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  450. 7744.75ec: ChangeTime: 2020-04-23T01:09:23.871662000Z
  451. 7744.75ec: FileAttributes: 0x20
  452. 7744.75ec: Size: 0x1e8460
  453. 7744.75ec: NT Headers: 0xd8
  454. 7744.75ec: Timestamp: 0xb29ecf52
  455. 7744.75ec: Machine: 0x8664 - amd64
  456. 7744.75ec: Timestamp: 0xb29ecf52
  457. 7744.75ec: Image Version: 10.0
  458. 7744.75ec: SizeOfImage: 0x1f0000 (2031616)
  459. 7744.75ec: Resource Dir: 0x17f000 LB 0x6f310
  460. 7744.75ec: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  461. 7744.75ec: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  462. 7744.75ec: ProductName: Microsoft® Windows® Operating System
  463. 7744.75ec: ProductVersion: 10.0.18362.815
  464. 7744.75ec: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  465. 7744.75ec: FileDescription: NT Layer DLL
  466. 7744.75ec: \SystemRoot\System32\kernel32.dll:
  467. 7744.75ec: CreationTime: 2020-04-15T06:24:41.285620100Z
  468. 7744.75ec: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  469. 7744.75ec: ChangeTime: 2020-04-23T01:01:11.952622000Z
  470. 7744.75ec: FileAttributes: 0x20
  471. 7744.75ec: Size: 0xb0498
  472. 7744.75ec: NT Headers: 0xe8
  473. 7744.75ec: Timestamp: 0x21b07e83
  474. 7744.75ec: Machine: 0x8664 - amd64
  475. 7744.75ec: Timestamp: 0x21b07e83
  476. 7744.75ec: Image Version: 10.0
  477. 7744.75ec: SizeOfImage: 0xb2000 (729088)
  478. 7744.75ec: Resource Dir: 0xb0000 LB 0x520
  479. 7744.75ec: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  480. 7744.75ec: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  481. 7744.75ec: ProductName: Microsoft® Windows® Operating System
  482. 7744.75ec: ProductVersion: 10.0.18362.778
  483. 7744.75ec: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  484. 7744.75ec: FileDescription: Windows NT BASE API Client DLL
  485. 7744.75ec: \SystemRoot\System32\KernelBase.dll:
  486. 7744.75ec: CreationTime: 2020-04-23T01:00:41.758247200Z
  487. 7744.75ec: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  488. 7744.75ec: ChangeTime: 2020-04-23T01:09:23.809157500Z
  489. 7744.75ec: FileAttributes: 0x20
  490. 7744.75ec: Size: 0x2a4068
  491. 7744.75ec: NT Headers: 0xf8
  492. 7744.75ec: Timestamp: 0xb89efff3
  493. 7744.75ec: Machine: 0x8664 - amd64
  494. 7744.75ec: Timestamp: 0xb89efff3
  495. 7744.75ec: Image Version: 10.0
  496. 7744.75ec: SizeOfImage: 0x2a4000 (2768896)
  497. 7744.75ec: Resource Dir: 0x27e000 LB 0x548
  498. 7744.75ec: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  499. 7744.75ec: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  500. 7744.75ec: ProductName: Microsoft® Windows® Operating System
  501. 7744.75ec: ProductVersion: 10.0.18362.815
  502. 7744.75ec: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  503. 7744.75ec: FileDescription: Windows NT BASE API Client DLL
  504. 7744.75ec: \SystemRoot\System32\apisetschema.dll:
  505. 7744.75ec: CreationTime: 2019-03-19T04:43:54.837151500Z
  506. 7744.75ec: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  507. 7744.75ec: ChangeTime: 2020-04-23T01:01:11.931617700Z
  508. 7744.75ec: FileAttributes: 0x20
  509. 7744.75ec: Size: 0x1d028
  510. 7744.75ec: NT Headers: 0xc8
  511. 7744.75ec: Timestamp: 0xd6ced080
  512. 7744.75ec: Machine: 0x8664 - amd64
  513. 7744.75ec: Timestamp: 0xd6ced080
  514. 7744.75ec: Image Version: 10.0
  515. 7744.75ec: SizeOfImage: 0x1e000 (122880)
  516. 7744.75ec: Resource Dir: 0x1d000 LB 0x408
  517. 7744.75ec: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  518. 7744.75ec: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  519. 7744.75ec: ProductName: Microsoft® Windows® Operating System
  520. 7744.75ec: ProductVersion: 10.0.18362.1
  521. 7744.75ec: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  522. 7744.75ec: FileDescription: ApiSet Schema DLL
  523. 7744.75ec: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  524. 7744.75ec: supR3HardenedWinFindAdversaries: 0x0
  525. 7744.75ec: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  526. 7744.75ec: Calling main()
  527. 7744.75ec: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  528. 7744.75ec: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  529. 7744.75ec: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  530. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  531. 7744.75ec: SUPR3HardenedMain: Final process, opening VBoxDrv...
  532. 7744.75ec: supR3HardenedEarlyCompact: Removed heap 1 (0x00000001300000 LB 0x400000)
  533. 7744.75ec: supR3HardNtEnableThreadCreationEx:
  534. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  535. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  536. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  537. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  538. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbaa3a0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  539. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  540. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  541. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  542. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  543. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  544. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  545. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  546. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  547. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  548. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msasn1.dll'.
  549. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  550. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  551. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wintrust.dll)
  552. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wintrust.dll
  553. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  554. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  555. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll)
  556. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  557. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  558. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume4\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  559. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msasn1.dll'.
  560. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\crypt32.dll)
  561. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  562. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  563. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume4\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  564. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msasn1.dll)
  565. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msasn1.dll
  566. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  567. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  568. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msvcrt.dll)
  569. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  570. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  571. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume4\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  572. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  573. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  574. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8cf0000 LB 0x0009e000 C:\WINDOWS\System32\msvcrt.dll [fFlags=0x0]
  575. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  576. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7460000 LB 0x00012000 C:\WINDOWS\System32\MSASN1.dll [fFlags=0x0]
  577. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  578. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7680000 LB 0x000fa000 C:\WINDOWS\System32\ucrtbase.dll [fFlags=0x0]
  579. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ucrtbase.dll)
  580. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ucrtbase.dll
  581. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8480000 LB 0x00149000 C:\WINDOWS\System32\CRYPT32.dll [fFlags=0x0]
  582. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  583. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb9860000 LB 0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  584. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  585. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7ca0000 LB 0x0005c000 C:\WINDOWS\System32\Wintrust.dll [fFlags=0x0]
  586. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  587. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  588. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  589. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  590. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  591. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  592. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  593. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  594. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  595. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  596. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  597. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  598. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  599. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  600. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  601. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-1'
  602. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\system32\Wintrust.dll'
  603. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\bcrypt.dll)
  604. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  605. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  606. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7650000 LB 0x00026000 C:\WINDOWS\System32\bcrypt.dll [fFlags=0x0]
  607. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  608. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7650000 'C:\WINDOWS\system32\bcrypt.dll'
  609. 7744.75ec: bcrypt.dll loaded at 00007ffbb7650000, BCryptOpenAlgorithmProvider at 00007ffbb7654c70, preloading providers:
  610. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll)
  611. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll
  612. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  613. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7850000 LB 0x00080000 C:\WINDOWS\System32\bcryptprimitives.dll [fFlags=0x0]
  614. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  615. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7850000 'C:\WINDOWS\system32\bcryptprimitives.dll'
  616. 7744.75ec: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000017ad6b0)
  617. 7744.75ec: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000017aec20)
  618. 7744.75ec: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=00000000017aef20)
  619. 7744.75ec: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=00000000017af220)
  620. 7744.75ec: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=00000000017af520)
  621. 7744.75ec: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000017af820)
  622. 7744.75ec: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000017afb90)
  623. 7744.75ec: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=00000000017afe90)
  624. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb78d0000 LB 0x00017000 C:\WINDOWS\System32\CRYPTSP.dll [fFlags=0x0]
  625. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cryptsp.dll)
  626. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptsp.dll
  627. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
  628. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rsaenh.dll)
  629. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  630. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  631. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  632. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  633. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  634. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  635. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb67c0000 LB 0x00033000 C:\WINDOWS\system32\rsaenh.dll [fFlags=0x0]
  636. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  637. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  638. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
  639. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cryptbase.dll)
  640. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptbase.dll
  641. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb6e20000 LB 0x0000c000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
  642. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  643. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  644. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  645. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  646. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  647. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  648. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\kernel32.dll'
  649. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  650. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  651. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\System32\WINTRUST.DLL'
  652. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  653. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  654. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\CRYPT32.dll'
  655. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb9980000 LB 0x0001d000 C:\WINDOWS\System32\imagehlp.dll [fFlags=0x0]
  656. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'rpcrt4.dll'.
  657. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\imagehlp.dll)
  658. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\imagehlp.dll
  659. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  660. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  661. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  662. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  663. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  664. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  665. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb9740000 LB 0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  666. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  667. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\sechost.dll)
  668. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\sechost.dll
  669. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  670. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  671. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gpapi.dll)
  672. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gpapi.dll
  673. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb6000000 LB 0x00022000 C:\WINDOWS\SYSTEM32\gpapi.dll [fFlags=0x0]
  674. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  675. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7480000 LB 0x00023000 C:\WINDOWS\System32\profapi.dll [fFlags=0x0]
  676. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\profapi.dll)
  677. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\profapi.dll
  678. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  679. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
  680. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\cryptnet.dll)
  681. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptnet.dll
  682. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  683. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume4\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  684. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  685. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  686. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  687. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  688. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  689. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  690. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  691. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  692. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  693. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  694. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  695. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  696. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  697. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  698. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  699. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb19e0000 LB 0x0002f000 C:\WINDOWS\System32\cryptnet.dll [fFlags=0x0]
  700. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  701. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  702. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  703. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  704. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  705. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  706. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  707. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  708. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  709. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  710. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  711. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  712. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  713. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  714. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  715. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  716. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  717. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  718. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  719. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  720. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  721. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  722. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  723. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  724. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  725. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  726. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  727. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  728. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  729. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  730. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  731. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\Windows\System32\cryptnet.dll'
  732. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8be0000 LB 0x000a3000 C:\WINDOWS\System32\advapi32.dll [fFlags=0x0]
  733. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  734. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
  735. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  736. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\advapi32.dll)
  737. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  738. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  739. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  740. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  741. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  742. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
  743. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume4\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
  744. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  745. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  746. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  747. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  748. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  749. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  750. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  751. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  752. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  753. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  754. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000018032c0
  755. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  756. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2F110B40CF67FEF4EFA84C23431B3B42233E381F
  757. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  758. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  759. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9860000 'C:\WINDOWS\System32\rpcrt4.dll'
  760. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  761. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  762. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  763. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  764. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  765. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  766. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.815.cat'; file='\SystemRoot\System32\ntdll.dll'
  767. 7744.75ec: g_pfnWinVerifyTrust=00007ffbb7ca61f0
  768. 7744.75ec: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  769. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  770. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  771. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  772. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  773. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  774. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  775. 7744.75ec: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\crypt32.dll'
  776. 7744.75ec: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  777. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  778. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  779. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  780. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  781. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  782. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  783. 7744.75ec: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\wintrust.dll'
  784. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  785. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  786. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  787. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  788. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\advapi32.dll'
  789. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a8 pwszName=\Device\HarddiskVolume4\Windows\System32\cryptnet.dll
  790. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  791. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  792. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09032EBC3D9D9BDDC0EE4A6463C043296B79FF20
  793. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  794. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  795. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  796. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.815.cat'; file='\Device\HarddiskVolume4\Windows\System32\cryptnet.dll'
  797. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  798. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptnet.dll'
  799. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  800. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  801. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  802. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\profapi.dll'
  803. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  804. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  805. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  806. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\gpapi.dll'
  807. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  808. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  809. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  810. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\sechost.dll'
  811. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  812. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  813. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  814. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\imagehlp.dll'
  815. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  816. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  817. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  818. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptbase.dll'
  819. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  820. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  821. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  822. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  823. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  824. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\rsaenh.dll'
  825. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  826. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  827. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  828. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  829. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptsp.dll'
  830. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  831. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  832. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll'
  833. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  834. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  835. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll'
  836. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  837. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  838. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\ucrtbase.dll'
  839. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  840. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  841. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll'
  842. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  843. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  844. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msasn1.dll'
  845. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  846. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  847. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll'
  848. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  849. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  850. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  851. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe'
  852. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  853. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  854. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\KernelBase.dll'
  855. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  856. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  857. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\kernel32.dll'
  858. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\system32\crypt32.dll'
  859. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  860. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  861. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  862. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
  863. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  864. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  865. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  866. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
  867. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  868. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  869. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
  870. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root Certificate Authority 2014
  871. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa12b07674f1bf600 C=US, O=AffirmTrust, CN=AffirmTrust Commercial
  872. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
  873. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  874. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x50bb81640c01cb00 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  875. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  876. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  877. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  878. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  879. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  880. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  881. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  882. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  883. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  884. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd944bca189a00 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
  885. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  886. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  887. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  888. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  889. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  890. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  891. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  892. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
  893. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  894. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xbebef0d2217f0bfb C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3
  895. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  896. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  897. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, [email protected]
  898. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  899. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  900. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x665014bdbcc8f800 O=Cybertrust, Inc, CN=Cybertrust Global Root
  901. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb352b1523915d000 C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2
  902. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  903. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x73e85f1bda5faa00 C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2
  904. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
  905. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  906. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  907. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  908. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  909. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  910. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  911. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  912. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
  913. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  914. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
  915. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xdc1801b225aea100 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3
  916. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  917. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  918. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  919. 7744.75ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  920. 7744.75ec: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=61
  921. 7744.75ec: SUPR3HardenedMain: Load Runtime...
  922. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  923. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  924. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  925. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  926. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  927. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  928. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  929. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  930. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  931. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  932. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  933. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  934. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ws2_32.dll) WinVerifyTrust
  935. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  936. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  937. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  938. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  939. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  940. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  941. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  942. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  943. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  944. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  945. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  946. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  947. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  948. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  949. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  950. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  951. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  952. 7744.75ec: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  953. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll)
  954. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  955. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  956. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  957. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  958. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  959. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  960. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  961. 7744.75ec: supR3HardenedDllNotificationCallback: load 0000000053db0000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  962. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  963. 7744.75ec: supR3HardenedDllNotificationCallback: load 0000000053d10000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  964. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  965. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb97f0000 LB 0x0006f000 C:\WINDOWS\System32\WS2_32.dll [fFlags=0x0]
  966. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  967. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffb5fef0000 LB 0x005e2000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  968. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  969. 7744.75ec: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  970. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  971. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  972. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  973. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  974. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  975. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  976. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  977. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  978. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  979. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  980. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  981. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  982. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  983. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  984. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  985. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  986. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  987. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  988. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  989. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  990. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  991. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  992. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  993. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  994. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  995. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  996. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  997. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  998. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  999. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1000. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1001. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1002. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1003. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1004. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1005. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1006. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1007. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1008. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1009. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1010. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1011. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1012. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1013. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1014. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1015. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1016. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1017. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1018. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1019. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1020. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll
  1021. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1022. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\system32\Wintrust.dll'
  1023. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1024. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1025. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  1026. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1027. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1028. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1029. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\system32\crypt32.dll'
  1030. 7744.75ec: SUPR3HardenedMain: Load TrustedMain...
  1031. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1032. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1033. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  1034. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
  1035. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  1036. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1037. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
  1038. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1039. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll) WinVerifyTrust
  1040. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1041. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1042. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1043. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1044. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1045. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1046. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
  1047. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\user32.dll) WinVerifyTrust
  1048. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\user32.dll
  1049. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1050. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1051. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1052. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1053. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1054. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1055. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1056. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1057. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1058. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1059. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1060. 7744.75ec: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1061. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'win32u.dll'.
  1062. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gdi32.dll)
  1063. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1064. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1065. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1066. 7744.75ec: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1067. 7744.75ec: '\Device\HarddiskVolume4\Windows\System32\win32u.dll' has no imports
  1068. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\win32u.dll)
  1069. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1070. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1071. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1072. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1073. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1074. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  1075. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1076. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1077. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1078. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
  1079. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  1080. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\oleaut32.dll) WinVerifyTrust
  1081. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1082. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1083. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1084. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1085. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1086. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1087. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1088. 7744.75ec: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\combase.dll'.
  1089. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1090. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'bcryptprimitives.dll'.
  1091. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\combase.dll)
  1092. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\combase.dll
  1093. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1094. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1095. 7744.75ec: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1096. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll)
  1097. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll
  1098. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  1099. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  1100. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll
  1101. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1102. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1103. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1104. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1105. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
  1106. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'gdi32.dll'.
  1107. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'user32.dll'.
  1108. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #58 'combase.dll'.
  1109. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ole32.dll) WinVerifyTrust
  1110. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1111. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1112. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1113. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [redoing WinVerifyTrust]
  1114. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1115. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1116. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1117. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1118. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1119. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1120. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1121. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1122. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1123. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1124. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1125. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1126. 7744.75ec: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'
  1127. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  1128. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1129. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8dd0000 LB 0x00336000 C:\WINDOWS\System32\combase.dll [fFlags=0x0]
  1130. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [avoiding WinVerifyTrust]
  1131. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb7780000 LB 0x00021000 C:\WINDOWS\System32\win32u.dll [fFlags=0x0]
  1132. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
  1133. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb77b0000 LB 0x0009e000 C:\WINDOWS\System32\msvcp_win.dll [fFlags=0x0]
  1134. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
  1135. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbba2c0000 LB 0x00194000 C:\WINDOWS\System32\USER32.dll [fFlags=0x0]
  1136. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1137. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb74b0000 LB 0x00194000 C:\WINDOWS\System32\gdi32full.dll [fFlags=0x0]
  1138. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1139. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1140. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'user32.dll'.
  1141. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'win32u.dll'.
  1142. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gdi32full.dll)
  1143. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gdi32full.dll
  1144. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8da0000 LB 0x00026000 C:\WINDOWS\System32\GDI32.dll [fFlags=0x0]
  1145. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
  1146. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb88e0000 LB 0x00157000 C:\WINDOWS\System32\ole32.dll [fFlags=0x0]
  1147. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1148. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8a40000 LB 0x000c4000 C:\WINDOWS\System32\OLEAUT32.dll [fFlags=0x0]
  1149. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1150. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba0a30000 LB 0x00052000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll [fFlags=0x0]
  1151. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1152. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32full.dll'.
  1153. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\gdi32full.dll' [rescheduled]
  1154. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1155. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rescheduled]
  1156. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\combase.dll'.
  1157. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rescheduled]
  1158. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1159. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rescheduled]
  1160. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1161. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rescheduled]
  1162. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  1163. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1164. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1165. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1166. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1167. 7744.75ec: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1168. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1169. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1170. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1171. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1172. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1173. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1174. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1175. 7744.75ec: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1176. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1177. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1178. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  1179. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1180. 7744.75ec: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll
  1181. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1182. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\kernel32.dll'
  1183. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  1184. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1185. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-string-l1-1-0'
  1186. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  1187. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1188. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-datetime-l1-1-1'
  1189. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  1190. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1191. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-obsolete-l1-2-0'
  1192. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\imm32.dll'.
  1193. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1194. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
  1195. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\imm32.dll)
  1196. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\imm32.dll
  1197. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1198. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1199. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1200. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1201. 7744.75ec: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1202. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1203. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1204. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1205. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1206. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb9b30000 LB 0x0002e000 C:\WINDOWS\System32\IMM32.DLL [fFlags=0x0]
  1207. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
  1208. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9b30000 'C:\WINDOWS\system32\IMM32.DLL'
  1209. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\imm32.dll'.
  1210. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\imm32.dll' [rescheduled]
  1211. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba0a30000 'C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll'
  1212. 7744.75ec: SUPR3HardenedMain: Calling TrustedMain (00007ffba0a32d70)...
  1213. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb73f0000 LB 0x00011000 C:\WINDOWS\System32\kernel.appcore.dll [fFlags=0x0]
  1214. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
  1215. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  1216. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll)
  1217. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll
  1218. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb9a80000 LB 0x000a2000 C:\WINDOWS\System32\clbcatq.dll [fFlags=0x0]
  1219. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1220. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
  1221. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\clbcatq.dll)
  1222. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\clbcatq.dll
  1223. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1224. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1225. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1226. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1227. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1228. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1229. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1230. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1231. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1232. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1233. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1234. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1235. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\clbcatq.dll'
  1236. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1237. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1238. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll'
  1239. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1240. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1241. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1242. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1243. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1244. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1245. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1246. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
  1247. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1248. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1249. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1250. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1251. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1252. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1253. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1254. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1255. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1256. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1257. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1258. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1259. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1260. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1261. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1262. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1263. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1264. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1265. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1266. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1267. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffb68080000 LB 0x003a4000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  1268. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1269. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb68080000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  1270. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1271. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1272. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1273. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1274. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
  1275. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1276. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1277. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1278. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
  1279. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1280. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1281. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1282. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1283. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1284. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1285. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1286. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1287. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1288. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1289. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1290. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1291. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1292. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1293. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'gdi32.dll'.
  1294. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'user32.dll'.
  1295. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\shlwapi.dll) WinVerifyTrust
  1296. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\shlwapi.dll
  1297. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1298. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1299. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1300. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1301. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1302. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1303. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1304. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1305. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1306. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1307. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1308. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1309. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1310. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1311. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1312. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1313. 7744.75ec: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'
  1314. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1315. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1316. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1317. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1318. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1319. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb8c90000 LB 0x00052000 C:\WINDOWS\System32\SHLWAPI.dll [fFlags=0x0]
  1320. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\shlwapi.dll
  1321. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffb9e730000 LB 0x000d5000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
  1322. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1323. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb9e730000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
  1324. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1325. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1326. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8a40000 'C:\Windows\System32\oleaut32.dll'
  1327. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1328. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1329. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb88e0000 'C:\WINDOWS\System32\ole32.dll'
  1330. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1331. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\OLEAUT32.dll (Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1332. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8a40000 'C:\WINDOWS\System32\OLEAUT32.dll'
  1333. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007b4 pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1334. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1335. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1336. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DB1AA7E2E4704C908EC9382E1F9E64808B9E5E1D
  1337. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1338. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1339. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll'
  1340. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1341. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1342. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1343. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
  1344. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
  1345. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1346. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  1347. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  1348. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000794 pwszName=\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1349. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1350. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1351. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=22EAF38FA276D7A374D3945ACD556FA0953D3440
  1352. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1353. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1354. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll'
  1355. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1356. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1357. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'bcrypt.dll'.
  1358. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'ws2_32.dll'.
  1359. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll) WinVerifyTrust
  1360. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1361. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1362. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1363. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1364. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1365. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1366. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1367. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1368. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1369. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1370. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1371. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1372. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  1373. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1374. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1375. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1376. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1377. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1378. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba9870000 LB 0x00084000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [fFlags=0x0]
  1379. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1380. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbaa580000 LB 0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [fFlags=0x0]
  1381. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1382. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
  1383. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1384. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  1385. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa580000 'C:\WINDOWS\system32\wbem\wbemprox.dll'
  1386. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007f4 pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1387. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1388. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1389. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=00C864D7F76A7AD25E7D0DA164B0B66188F5B7FF
  1390. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1391. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1392. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll'
  1393. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1394. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1395. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  1396. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
  1397. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1398. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1399. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1400. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  1401. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1402. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1403. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1404. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1405. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba9200000 LB 0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [fFlags=0x0]
  1406. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1407. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9200000 'C:\WINDOWS\system32\wbem\wbemsvc.dll'
  1408. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
  1409. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1410. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-0.dll'
  1411. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
  1412. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1413. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
  1414. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007bc pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1415. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1416. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1417. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0708A64F48237CD4D5092546CE9C373F20B30CA1
  1418. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1419. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1420. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll'
  1421. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1422. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1423. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'wbemcomn.dll'.
  1424. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
  1425. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1426. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  1427. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  1428. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1429. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1430. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1431. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1432. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1433. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba9220000 LB 0x00101000 C:\WINDOWS\system32\wbem\fastprox.dll [fFlags=0x0]
  1434. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1435. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9220000 'C:\WINDOWS\system32\wbem\fastprox.dll'
  1436. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007c0 pwszName=\Device\HarddiskVolume4\Windows\System32\amsi.dll
  1437. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1438. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1439. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B5D4D58A583ACAD5AA76D7DD0F2DB8ADE903942B
  1440. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1441. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1442. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.18362.720.cat'; file='\Device\HarddiskVolume4\Windows\System32\amsi.dll'
  1443. 7744.75ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1444. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1445. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  1446. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'userenv.dll'.
  1447. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\amsi.dll) WinVerifyTrust
  1448. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1449. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'userenv.dll'...
  1450. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' -> '\Device\HarddiskVolume4\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
  1451. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1452. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1453. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  1454. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'profapi.dll'.
  1455. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\userenv.dll) WinVerifyTrust
  1456. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1457. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1458. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1459. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1460. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1461. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1462. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1463. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\profapi.dll
  1464. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1465. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1466. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\amsi.dll (Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1467. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1468. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1469. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb72d0000 LB 0x00025000 C:\WINDOWS\SYSTEM32\USERENV.dll [fFlags=0x0]
  1470. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1471. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba67a0000 LB 0x00015000 C:\WINDOWS\System32\amsi.dll [fFlags=0x0]
  1472. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1473. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba67a0000 'C:\WINDOWS\System32\amsi.dll'
  1474. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1475. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1476. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'oleaut32.dll'.
  1477. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  1478. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1479. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll) WinVerifyTrust
  1480. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1481. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1482. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1483. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1484. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1485. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1486. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1487. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1488. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1489. 7744.75ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1490. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1491. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1492. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffba6750000 LB 0x00046000 C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll [fFlags=0x0]
  1493. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1494. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1495. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1496. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  1497. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1498. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1499. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  1500. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1501. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1502. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  1503. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1504. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1505. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  1506. 7744.75ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  1507. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1508. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-1'
  1509. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\version.dll'.
  1510. 7744.75ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1511. 7744.75ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\version.dll)
  1512. 7744.75ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\version.dll
  1513. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1514. 7744.75ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1515. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\version.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1516. 7744.75ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\version.dll [avoiding WinVerifyTrust]
  1517. 7744.75ec: supR3HardenedDllNotificationCallback: load 00007ffbb1a20000 LB 0x0000a000 C:\WINDOWS\system32\version.dll [fFlags=0x0]
  1518. 7744.75ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\version.dll [avoiding WinVerifyTrust]
  1519. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb1a20000 'C:\WINDOWS\system32\version.dll'
  1520. 7744.75ec: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\version.dll'.
  1521. 7744.75ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\version.dll' [rescheduled]
  1522. 7744.75ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba6750000 'C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll'
  1523. 7744.1ce0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1524. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1525. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrem.dll'.
  1526. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1527. 7744.1ce0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
  1528. 7744.1ce0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1529. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1530. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1531. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrem.dll'...
  1532. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrem.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrem.dll' [rcNtRedir=0xc0150008]
  1533. 7744.1ce0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1534. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
  1535. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1536. 7744.1ce0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcrt.dll'.
  1537. 7744.1ce0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll) WinVerifyTrust
  1538. 7744.1ce0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1539. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1540. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1541. 7744.1ce0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1542. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1543. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1544. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1545. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1546. 7744.1ce0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1547. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1548. 7744.1ce0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1549. 7744.1ce0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1550. 7744.1ce0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1551. 7744.1ce0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1552. 7744.1ce0: supR3HardenedDllNotificationCallback: load 0000000053c00000 LB 0x0010b000 C:\Program Files\Oracle\VirtualBox\VBoxREM.dll [fFlags=0x0]
  1553. 7744.1ce0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1554. 7744.1ce0: supR3HardenedDllNotificationCallback: load 00007ffb6c740000 LB 0x00331000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
  1555. 7744.1ce0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1556. 7744.1ce0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb6c740000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  1557. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1558. 7744.3c50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1559. 7744.3c50: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1560. 7744.3c50: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1561. 7744.3c50: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1562. 7744.3c50: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1563. 7744.3c50: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
  1564. 7744.3c50: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1565. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1566. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1567. 7744.3c50: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1568. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1569. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1570. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1571. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1572. 7744.3c50: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1573. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1574. 7744.3c50: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1575. 7744.3c50: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1576. 7744.3c50: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1577. 7744.3c50: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1578. 7744.3c50: supR3HardenedDllNotificationCallback: load 00007ffbaa380000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
  1579. 7744.3c50: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1580. 7744.3c50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa380000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
  1581. 7744.3c50: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1582. 7744.3c50: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\User32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1583. 7744.3c50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbba2c0000 'C:\WINDOWS\system32\User32.dll'
  1584. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000978 pwszName=\Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1585. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000018032c0
  1586. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000018032c0
  1587. 7744.15d0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1588. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=286AD1CEC16EFDCA5718925D19E68A486A5851A0
  1589. 7744.4010: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1590. 7744.4010: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1591. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0415~31bf3856ad364e35~amd64~~10.0.18362.720.cat'; file='\Device\HarddiskVolume4\Windows\System32\uxtheme.dll'
  1592. 7744.4010: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1593. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1594. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1595. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
  1596. 7744.4010: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\uxtheme.dll) WinVerifyTrust
  1597. 7744.4010: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1598. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1599. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1600. 7744.4010: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1601. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1602. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1603. 7744.4010: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1604. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1605. 7744.4010: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1606. 7744.4010: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1607. 7744.4010: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1608. 7744.4010: supR3HardenedDllNotificationCallback: load 00007ffbb56c0000 LB 0x00099000 C:\WINDOWS\system32\uxtheme.dll [fFlags=0x0]
  1609. 7744.15d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1610. 7744.15d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1611. 7744.15d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1612. 7744.15d0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
  1613. 7744.4010: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1614. 7744.15d0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1615. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1616. 7744.4010: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb56c0000 'C:\WINDOWS\system32\uxtheme.dll'
  1617. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1618. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1619. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1620. 7744.15d0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1621. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1622. 7744.15d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1623. 7744.15d0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1624. 7744.15d0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1625. 7744.15d0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1626. 7744.15d0: supR3HardenedDllNotificationCallback: load 00007ffba9020000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
  1627. 7744.15d0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1628. 7744.15d0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9020000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
  1629. 7744.4010: supR3HardenedDllNotificationCallback: load 00007ffbb87a0000 LB 0x00136000 C:\WINDOWS\System32\MSCTF.dll [fFlags=0x0]
  1630. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1631. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'oleaut32.dll'.
  1632. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'user32.dll'.
  1633. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'gdi32.dll'.
  1634. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'imm32.dll'.
  1635. 7744.4010: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'advapi32.dll'.
  1636. 7744.4010: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msctf.dll)
  1637. 7744.4010: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msctf.dll
  1638. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1639. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1640. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1641. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1642. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume4\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1643. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1644. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1645. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1646. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1647. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1648. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1649. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1650. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1651. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1652. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1653. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1654. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1655. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1656. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1657. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #77 'user32.dll'.
  1658. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #79 'gdi32.dll'.
  1659. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\shell32.dll) WinVerifyTrust
  1660. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\shell32.dll
  1661. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1662. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1663. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1664. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1665. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1666. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1667. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb78f0000 LB 0x0004a000 C:\WINDOWS\System32\cfgmgr32.dll [fFlags=0x0]
  1668. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll)
  1669. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll
  1670. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb85d0000 LB 0x000a9000 C:\WINDOWS\System32\shcore.dll [fFlags=0x0]
  1671. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1672. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'rpcrt4.dll'.
  1673. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
  1674. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\SHCore.dll)
  1675. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\SHCore.dll
  1676. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb73e0000 LB 0x00010000 C:\WINDOWS\System32\UMPDC.dll [fFlags=0x0]
  1677. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\umpdc.dll)
  1678. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\umpdc.dll
  1679. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb7410000 LB 0x0004a000 C:\WINDOWS\System32\powrprof.dll [fFlags=0x0]
  1680. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  1681. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'umpdc.dll'.
  1682. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\powrprof.dll)
  1683. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\powrprof.dll
  1684. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb7d00000 LB 0x0077d000 C:\WINDOWS\System32\windows.storage.dll [fFlags=0x0]
  1685. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
  1686. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
  1687. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'rpcrt4.dll'.
  1688. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'profapi.dll'.
  1689. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\windows.storage.dll)
  1690. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\windows.storage.dll
  1691. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb9b60000 LB 0x006e4000 C:\WINDOWS\System32\Shell32.dll [fFlags=0x0]
  1692. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\shell32.dll
  1693. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9b60000 'C:\WINDOWS\system32\Shell32.dll'
  1694. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1695. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1696. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\profapi.dll
  1697. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1698. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1699. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1700. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1701. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [lacks WinVerifyTrust]
  1702. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1703. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1704. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1705. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'umpdc.dll'...
  1706. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'umpdc.dll' -> '\Device\HarddiskVolume4\Windows\System32\umpdc.dll' [rcNtRedir=0xc0150008]
  1707. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\umpdc.dll [lacks WinVerifyTrust]
  1708. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1709. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1710. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1711. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1712. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1713. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1714. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1715. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1716. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1717. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1718. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1719. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\windows.storage.dll'
  1720. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1721. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1722. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\powrprof.dll'
  1723. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1724. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1725. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\umpdc.dll'
  1726. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1727. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1728. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\SHCore.dll'
  1729. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1730. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1731. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll'
  1732. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1733. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1734. 7744.5fbc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msctf.dll'
  1735. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  1736. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1737. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1738. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1739. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1740. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1741. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1742. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
  1743. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
  1744. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1745. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  1746. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
  1747. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
  1748. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
  1749. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
  1750. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1751. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  1752. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  1753. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1754. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1755. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
  1756. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1757. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1758. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1759. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1760. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1761. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1762. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1763. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1764. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1765. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1766. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1767. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1768. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
  1769. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'cfgmgr32.dll'.
  1770. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'bcrypt.dll'.
  1771. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\setupapi.dll) WinVerifyTrust
  1772. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1773. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1774. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1775. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
  1776. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
  1777. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1778. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1779. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  1780. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1781. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1782. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll
  1783. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1784. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1785. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1786. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1787. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1788. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1789. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1790. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
  1791. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1792. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
  1793. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
  1794. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1795. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1796. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1797. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1798. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1799. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1800. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1801. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1802. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
  1803. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1804. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
  1805. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1806. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1807. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1808. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1809. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1810. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1811. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1812. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1813. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1814. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1815. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1816. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1817. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1818. 7744.5fbc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1819. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1820. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1821. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1822. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1823. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1824. 7744.5fbc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1825. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1826. 7744.5fbc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1827. 7744.5fbc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1828. 7744.5fbc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1829. 7744.5fbc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1830. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb9110000 LB 0x00470000 C:\WINDOWS\System32\SETUPAPI.dll [fFlags=0x0]
  1831. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1832. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffba6240000 LB 0x00064000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
  1833. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1834. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffb9f060000 LB 0x0005c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
  1835. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1836. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb6960000 LB 0x0003a000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
  1837. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1838. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffb50590000 LB 0x009da000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
  1839. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1840. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb50590000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
  1841. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1842. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1843. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1844. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb68080000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
  1845. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1846. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1847. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1848. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb9f060000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
  1849. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1850. 7744.11e3c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1851. 7744.11e3c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1852. 7744.11e3c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1853. 7744.11e3c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1854. 7744.11e3c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
  1855. 7744.11e3c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1856. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1857. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1858. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1859. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1860. 7744.11e3c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1861. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1862. 7744.11e3c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1863. 7744.11e3c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1864. 7744.11e3c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1865. 7744.11e3c: supR3HardenedDllNotificationCallback: load 00007ffba9000000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
  1866. 7744.11e3c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1867. 7744.11e3c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9000000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
  1868. 7744.11ecc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1869. 7744.11ecc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1870. 7744.11ecc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1871. 7744.11ecc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  1872. 7744.11ecc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  1873. 7744.11ecc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
  1874. 7744.11ecc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1875. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1876. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1877. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1878. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1879. 7744.11ecc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1880. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1881. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1882. 7744.11ecc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1883. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1884. 7744.11ecc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1885. 7744.11ecc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1886. 7744.11ecc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1887. 7744.11ecc: supR3HardenedDllNotificationCallback: load 00007ffba8c50000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
  1888. 7744.11ecc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1889. 7744.11ecc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba8c50000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
  1890. 7744.11f7c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1891. 7744.11f7c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1892. 7744.11f7c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1893. 7744.11f7c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1894. 7744.11f7c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
  1895. 7744.11f7c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1896. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1897. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1898. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1899. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1900. 7744.11f7c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1901. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1902. 7744.11f7c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1903. 7744.11f7c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1904. 7744.11f7c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1905. 7744.11f7c: supR3HardenedDllNotificationCallback: load 00007ffba8c40000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
  1906. 7744.11f7c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1907. 7744.11f7c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba8c40000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
  1908. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1909. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Iphlpapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1910. 7744.5fbc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb6960000 'C:\WINDOWS\system32\Iphlpapi.dll'
  1911. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1912. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
  1913. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\winnsi.dll)
  1914. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\winnsi.dll
  1915. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb8d90000 LB 0x00008000 C:\WINDOWS\System32\NSI.dll [fFlags=0x0]
  1916. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\nsi.dll)
  1917. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\nsi.dll
  1918. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb1a10000 LB 0x0000b000 C:\WINDOWS\SYSTEM32\WINNSI.DLL [fFlags=0x0]
  1919. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
  1920. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1921. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll)
  1922. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll
  1923. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb19c0000 LB 0x00016000 C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL [fFlags=0x0]
  1924. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll [avoiding WinVerifyTrust]
  1925. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1926. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
  1927. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'nsi.dll'.
  1928. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll)
  1929. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll
  1930. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb1840000 LB 0x0001c000 C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL [fFlags=0x0]
  1931. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll [avoiding WinVerifyTrust]
  1932. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'ws2_32.dll'.
  1933. 7744.5fbc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'nsi.dll'.
  1934. 7744.5fbc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\dnsapi.dll)
  1935. 7744.5fbc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dnsapi.dll
  1936. 7744.5fbc: supR3HardenedDllNotificationCallback: load 00007ffbb69a0000 LB 0x000cb000 C:\WINDOWS\SYSTEM32\DNSAPI.dll [fFlags=0x0]
  1937. 7744.5fbc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\dnsapi.dll [avoiding WinVerifyTrust]
  1938. 7944.787c: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 405272 ms, the end);
  1939. 2bf0.7b98: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 405984 ms, the end);
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!