API tools faq
paste
Advertisement
joeybuddy96

cleaned up 02

joeybuddy96
Apr 23rd, 2020
49
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 215.99 KB | None | 0 0
raw download clone embed print report
  1. 7830.7a34: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000088 g_uNtVerCombined=0xa047bb00
  2. 7830.7a34: \SystemRoot\System32\ntdll.dll:
  3. 7830.7a34: CreationTime: 2020-04-23T01:00:41.383162400Z
  4. 7830.7a34: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  5. 7830.7a34: ChangeTime: 2020-04-23T01:09:23.871662000Z
  6. 7830.7a34: FileAttributes: 0x20
  7. 7830.7a34: Size: 0x1e8460
  8. 7830.7a34: NT Headers: 0xd8
  9. 7830.7a34: Timestamp: 0xb29ecf52
  10. 7830.7a34: Machine: 0x8664 - amd64
  11. 7830.7a34: Timestamp: 0xb29ecf52
  12. 7830.7a34: Image Version: 10.0
  13. 7830.7a34: SizeOfImage: 0x1f0000 (2031616)
  14. 7830.7a34: Resource Dir: 0x17f000 LB 0x6f310
  15. 7830.7a34: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 7830.7a34: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 7830.7a34: ProductName: Microsoft® Windows® Operating System
  18. 7830.7a34: ProductVersion: 10.0.18362.815
  19. 7830.7a34: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  20. 7830.7a34: FileDescription: NT Layer DLL
  21. 7830.7a34: \SystemRoot\System32\kernel32.dll:
  22. 7830.7a34: CreationTime: 2020-04-15T06:24:41.285620100Z
  23. 7830.7a34: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  24. 7830.7a34: ChangeTime: 2020-04-23T01:01:11.952622000Z
  25. 7830.7a34: FileAttributes: 0x20
  26. 7830.7a34: Size: 0xb0498
  27. 7830.7a34: NT Headers: 0xe8
  28. 7830.7a34: Timestamp: 0x21b07e83
  29. 7830.7a34: Machine: 0x8664 - amd64
  30. 7830.7a34: Timestamp: 0x21b07e83
  31. 7830.7a34: Image Version: 10.0
  32. 7830.7a34: SizeOfImage: 0xb2000 (729088)
  33. 7830.7a34: Resource Dir: 0xb0000 LB 0x520
  34. 7830.7a34: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 7830.7a34: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 7830.7a34: ProductName: Microsoft® Windows® Operating System
  37. 7830.7a34: ProductVersion: 10.0.18362.778
  38. 7830.7a34: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  39. 7830.7a34: FileDescription: Windows NT BASE API Client DLL
  40. 7830.7a34: \SystemRoot\System32\KernelBase.dll:
  41. 7830.7a34: CreationTime: 2020-04-23T01:00:41.758247200Z
  42. 7830.7a34: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  43. 7830.7a34: ChangeTime: 2020-04-23T01:09:23.809157500Z
  44. 7830.7a34: FileAttributes: 0x20
  45. 7830.7a34: Size: 0x2a4068
  46. 7830.7a34: NT Headers: 0xf8
  47. 7830.7a34: Timestamp: 0xb89efff3
  48. 7830.7a34: Machine: 0x8664 - amd64
  49. 7830.7a34: Timestamp: 0xb89efff3
  50. 7830.7a34: Image Version: 10.0
  51. 7830.7a34: SizeOfImage: 0x2a4000 (2768896)
  52. 7830.7a34: Resource Dir: 0x27e000 LB 0x548
  53. 7830.7a34: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 7830.7a34: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  55. 7830.7a34: ProductName: Microsoft® Windows® Operating System
  56. 7830.7a34: ProductVersion: 10.0.18362.815
  57. 7830.7a34: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  58. 7830.7a34: FileDescription: Windows NT BASE API Client DLL
  59. 7830.7a34: \SystemRoot\System32\apisetschema.dll:
  60. 7830.7a34: CreationTime: 2019-03-19T04:43:54.837151500Z
  61. 7830.7a34: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  62. 7830.7a34: ChangeTime: 2020-04-23T01:01:11.931617700Z
  63. 7830.7a34: FileAttributes: 0x20
  64. 7830.7a34: Size: 0x1d028
  65. 7830.7a34: NT Headers: 0xc8
  66. 7830.7a34: Timestamp: 0xd6ced080
  67. 7830.7a34: Machine: 0x8664 - amd64
  68. 7830.7a34: Timestamp: 0xd6ced080
  69. 7830.7a34: Image Version: 10.0
  70. 7830.7a34: SizeOfImage: 0x1e000 (122880)
  71. 7830.7a34: Resource Dir: 0x1d000 LB 0x408
  72. 7830.7a34: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 7830.7a34: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  74. 7830.7a34: ProductName: Microsoft® Windows® Operating System
  75. 7830.7a34: ProductVersion: 10.0.18362.1
  76. 7830.7a34: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  77. 7830.7a34: FileDescription: ApiSet Schema DLL
  78. 7830.7a34: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 7830.7a34: supR3HardenedWinFindAdversaries: 0x0
  80. 7830.7a34: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  81. 7830.7a34: Calling main()
  82. 7830.7a34: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  83. 7830.7a34: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  84. 7830.7a34: SUPR3HardenedMain: Respawn #1
  85. 7830.7a34: System32: \Device\HarddiskVolume4\Windows\System32
  86. 7830.7a34: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  87. 7830.7a34: KnownDllPath: C:\WINDOWS\System32
  88. 7830.7a34: supR3HardenedWinInit: Performing a limited self purification...
  89. 7830.7a34: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
  90. 7830.7a34: *0000000000000000-0000000000e2ffff 0x0001/0x0000 0x0000000
  91. 7830.7a34: *0000000000e30000-0000000000e3ffff 0x0004/0x0004 0x0040000
  92. 7830.7a34: 0000000000e40000-0000000000e4ffff 0x0001/0x0000 0x0000000
  93. 7830.7a34: *0000000000e50000-0000000000e6afff 0x0002/0x0002 0x0040000
  94. 7830.7a34: 0000000000e6b000-0000000000e6ffff 0x0001/0x0000 0x0000000
  95. 7830.7a34: *0000000000e70000-0000000000f28fff 0x0000/0x0004 0x0020000
  96. 7830.7a34: 0000000000f29000-0000000000f2bfff 0x0104/0x0004 0x0020000
  97. 7830.7a34: 0000000000f2c000-0000000000f6ffff 0x0004/0x0004 0x0020000
  98. 7830.7a34: *0000000000f70000-0000000000f73fff 0x0002/0x0002 0x0040000
  99. 7830.7a34: 0000000000f74000-0000000000f7ffff 0x0001/0x0000 0x0000000
  100. 7830.7a34: *0000000000f80000-0000000000f81fff 0x0004/0x0004 0x0020000
  101. 7830.7a34: 0000000000f82000-0000000000ffffff 0x0001/0x0000 0x0000000
  102. 7830.7a34: *0000000001000000-0000000001182fff 0x0000/0x0004 0x0020000
  103. 7830.7a34: 0000000001183000-0000000001185fff 0x0004/0x0004 0x0020000
  104. 7830.7a34: 0000000001186000-00000000011fffff 0x0000/0x0004 0x0020000
  105. 7830.7a34: *0000000001200000-00000000012c6fff 0x0002/0x0002 0x0040000
  106. 7830.7a34: 00000000012c7000-000000000130ffff 0x0001/0x0000 0x0000000
  107. 7830.7a34: *0000000001310000-0000000001316fff 0x0004/0x0004 0x0020000
  108. 7830.7a34: 0000000001317000-000000000140ffff 0x0000/0x0004 0x0020000
  109. 7830.7a34: *0000000001410000-000000000142cfff 0x0004/0x0004 0x0020000
  110. 7830.7a34: 000000000142d000-000000000150ffff 0x0000/0x0004 0x0020000
  111. 7830.7a34: 0000000001510000-000000000153ffff 0x0001/0x0000 0x0000000
  112. 7830.7a34: *0000000001540000-000000000154efff 0x0004/0x0004 0x0020000
  113. 7830.7a34: 000000000154f000-000000000154ffff 0x0000/0x0004 0x0020000
  114. 7830.7a34: *0000000001550000-000000000155bfff 0x0000/0x0004 0x0020000
  115. 7830.7a34: 000000000155c000-000000000174cfff 0x0004/0x0004 0x0020000
  116. 7830.7a34: 000000000174d000-000000000174dfff 0x0000/0x0004 0x0020000
  117. 7830.7a34: 000000000174e000-000000000174ffff 0x0001/0x0000 0x0000000
  118. 7830.7a34: *0000000001750000-0000000001751fff 0x0004/0x0004 0x0020000
  119. 7830.7a34: 0000000001752000-00000000018d4fff 0x0000/0x0004 0x0020000
  120. 7830.7a34: 00000000018d5000-000000007ffdffff 0x0001/0x0000 0x0000000
  121. 7830.7a34: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  122. 7830.7a34: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  123. 7830.7a34: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  124. 7830.7a34: 000000007ffe4000-00007ff49530ffff 0x0001/0x0000 0x0000000
  125. 7830.7a34: *00007ff495310000-00007ff495314fff 0x0002/0x0002 0x0040000
  126. 7830.7a34: 00007ff495315000-00007ff49540ffff 0x0000/0x0002 0x0040000
  127. 7830.7a34: *00007ff495410000-00007ff59542ffff 0x0000/0x0004 0x0020000
  128. 7830.7a34: *00007ff595430000-00007ff59742ffff 0x0000/0x0004 0x0020000
  129. 7830.7a34: 00007ff597430000-00007ff597430fff 0x0004/0x0004 0x0020000
  130. 7830.7a34: 00007ff597431000-00007ff59743ffff 0x0001/0x0000 0x0000000
  131. 7830.7a34: *00007ff597440000-00007ff597440fff 0x0002/0x0002 0x0040000
  132. 7830.7a34: 00007ff597441000-00007ff59744ffff 0x0001/0x0000 0x0000000
  133. 7830.7a34: *00007ff597450000-00007ff597472fff 0x0002/0x0002 0x0040000
  134. 7830.7a34: 00007ff597473000-00007ff617cbffff 0x0001/0x0000 0x0000000
  135. 7830.7a34: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  136. 7830.7a34: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  137. 7830.7a34: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  138. 7830.7a34: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  139. 7830.7a34: 00007ff617d7f000-00007ff617d81fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  140. 7830.7a34: 00007ff617d82000-00007ff617d84fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  141. 7830.7a34: 00007ff617d85000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  142. 7830.7a34: 00007ff617d88000-00007ff617d88fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  143. 7830.7a34: 00007ff617d89000-00007ff617d8afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  144. 7830.7a34: 00007ff617d8b000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  145. 7830.7a34: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  146. 7830.7a34: 00007ff617dd5000-00007ffbb79effff 0x0001/0x0000 0x0000000
  147. 7830.7a34: *00007ffbb79f0000-00007ffbb79f0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  148. 7830.7a34: 00007ffbb79f1000-00007ffbb7af5fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  149. 7830.7a34: 00007ffbb7af6000-00007ffbb7c58fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  150. 7830.7a34: 00007ffbb7c59000-00007ffbb7c5cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  151. 7830.7a34: 00007ffbb7c5d000-00007ffbb7c5dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  152. 7830.7a34: 00007ffbb7c5e000-00007ffbb7c93fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  153. 7830.7a34: 00007ffbb7c94000-00007ffbb86dffff 0x0001/0x0000 0x0000000
  154. 7830.7a34: *00007ffbb86e0000-00007ffbb86e0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  155. 7830.7a34: 00007ffbb86e1000-00007ffbb8755fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  156. 7830.7a34: 00007ffbb8756000-00007ffbb8787fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  157. 7830.7a34: 00007ffbb8788000-00007ffbb8788fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  158. 7830.7a34: 00007ffbb8789000-00007ffbb8789fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  159. 7830.7a34: 00007ffbb878a000-00007ffbb8791fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  160. 7830.7a34: 00007ffbb8792000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  161. 7830.7a34: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  162. 7830.7a34: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  163. 7830.7a34: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  164. 7830.7a34: 00007ffbba67f000-00007ffbba67ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  165. 7830.7a34: 00007ffbba680000-00007ffbba681fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  166. 7830.7a34: 00007ffbba682000-00007ffbba68afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  167. 7830.7a34: 00007ffbba68b000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  168. 7830.7a34: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  169. 7830.7a34: kernel32.dll: timestamp 0x21b07e83 (rc=VINF_SUCCESS)
  170. 7830.7a34: kernelbase.dll: timestamp 0xb89efff3 (rc=VINF_SUCCESS)
  171. 7830.7a34: VBoxHeadless.exe: timestamp 0x5d9f7c37 (rc=VINF_SUCCESS)
  172. 7830.7a34: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  173. 7830.7a34: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  174. 7830.7a34: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0
  175. 7830.7a34: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  176. 7830.7a34: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  177. 7830.7a34: supR3HardNtEnableThreadCreationEx:
  178. 7830.7a34: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  179. 7830.7a34: supR3HardenedWinDoReSpawn(1): New child 7ad8.7a84 [kernel32].
  180. 7830.7a34: supR3HardNtChildGatherData: PebBaseAddress=0000000000cff000 cbPeb=0x388
  181. 7830.7a34: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbba520000 uNtDllChildAddr=00007ffbba520000
  182. 7830.7a34: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbba591770
  183. 7830.7a34: supR3HardenedWinSetupChildInit: Start child.
  184. 7830.7a34: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  185. 7830.7a34: supR3HardNtChildPurify: Startup delay kludge #1/0: 265 ms, 30 sleeps
  186. 7830.7a34: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  187. 7830.7a34: *0000000000000000-0000000000b8ffff 0x0001/0x0000 0x0000000
  188. 7830.7a34: *0000000000b90000-0000000000baffff 0x0004/0x0004 0x0020000
  189. 7830.7a34: *0000000000bb0000-0000000000bcafff 0x0002/0x0002 0x0040000
  190. 7830.7a34: 0000000000bcb000-0000000000bcffff 0x0001/0x0000 0x0000000
  191. 7830.7a34: *0000000000bd0000-0000000000bd3fff 0x0002/0x0002 0x0040000
  192. 7830.7a34: 0000000000bd4000-0000000000bdffff 0x0001/0x0000 0x0000000
  193. 7830.7a34: *0000000000be0000-0000000000be1fff 0x0004/0x0004 0x0020000
  194. 7830.7a34: 0000000000be2000-0000000000bfffff 0x0001/0x0000 0x0000000
  195. 7830.7a34: *0000000000c00000-0000000000cfefff 0x0000/0x0004 0x0020000
  196. 7830.7a34: 0000000000cff000-0000000000d01fff 0x0004/0x0004 0x0020000
  197. 7830.7a34: 0000000000d02000-0000000000dfffff 0x0000/0x0004 0x0020000
  198. 7830.7a34: *0000000000e00000-0000000000efafff 0x0000/0x0004 0x0020000
  199. 7830.7a34: 0000000000efb000-0000000000efdfff 0x0104/0x0004 0x0020000
  200. 7830.7a34: 0000000000efe000-0000000000efffff 0x0004/0x0004 0x0020000
  201. 7830.7a34: 0000000000f00000-000000007ffdffff 0x0001/0x0000 0x0000000
  202. 7830.7a34: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  203. 7830.7a34: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  204. 7830.7a34: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  205. 7830.7a34: 000000007ffe4000-00007ff50bedffff 0x0001/0x0000 0x0000000
  206. 7830.7a34: *00007ff50bee0000-00007ff50bee0fff 0x0002/0x0002 0x0040000
  207. 7830.7a34: 00007ff50bee1000-00007ff50beeffff 0x0001/0x0000 0x0000000
  208. 7830.7a34: *00007ff50bef0000-00007ff50bf12fff 0x0002/0x0002 0x0040000
  209. 7830.7a34: 00007ff50bf13000-00007ff617cbffff 0x0001/0x0000 0x0000000
  210. 7830.7a34: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  211. 7830.7a34: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  212. 7830.7a34: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  213. 7830.7a34: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  214. 7830.7a34: 00007ff617d7f000-00007ff617d7ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  215. 7830.7a34: 00007ff617d80000-00007ff617d80fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  216. 7830.7a34: 00007ff617d81000-00007ff617d85fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  217. 7830.7a34: 00007ff617d86000-00007ff617d86fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  218. 7830.7a34: 00007ff617d87000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  219. 7830.7a34: 00007ff617d88000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  220. 7830.7a34: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  221. 7830.7a34: 00007ff617dd5000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  222. 7830.7a34: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  223. 7830.7a34: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  224. 7830.7a34: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  225. 7830.7a34: 00007ffbba67f000-00007ffbba68afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  226. 7830.7a34: 00007ffbba68b000-00007ffbba699fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  227. 7830.7a34: 00007ffbba69a000-00007ffbba69afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  228. 7830.7a34: 00007ffbba69b000-00007ffbba69dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  229. 7830.7a34: 00007ffbba69e000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  230. 7830.7a34: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  231. 7830.7a34: supR3HardNtChildPurify: Done after 281 ms and 0 fixes (loop #0).
  232. 7ad8.7a84: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000008 g_uNtVerCombined=0xa047bb00
  233. 7ad8.7a84: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbba520000 g_uNtVerCombined=0xa047bb00
  234. 7ad8.7a84: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
  235. 7ad8.7a84: New simple heap: #1 0000000001000000 LB 0x400000 (for 2031616 allocation)
  236. 7ad8.7a84: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  237. 7ad8.7a84: System32: \Device\HarddiskVolume4\Windows\System32
  238. 7ad8.7a84: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  239. 7830.7a34: supR3HardNtEnableThreadCreationEx:
  240. 7ad8.7a84: KnownDllPath: C:\WINDOWS\System32
  241. 7ad8.7a84: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  242. 7ad8.7a84: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  243. 7ad8.7a84: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  244. 7ad8.7a84: Registered Dll notification callback with NTDLL.
  245. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
  246. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  247. 7ad8.7a84: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  248. 7ad8.7a84: supR3HardenedDllNotificationCallback: load 00007ffbb79f0000 LB 0x002a4000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  249. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
  250. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  251. 7ad8.7a84: supR3HardenedDllNotificationCallback: load 00007ffbb86e0000 LB 0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  252. 7ad8.7a84: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  253. 7ad8.7a84: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  254. 7ad8.7a84: supR3HardenedDllNotificationCallback: load 00007ff617cc0000 LB 0x00115000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe [fFlags=0x0]
  255. 7ad8.7a84: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  256. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  257. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  258. 7ad8.7a84: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  259. 7ad8.7a84: \SystemRoot\System32\ntdll.dll:
  260. 7ad8.7a84: CreationTime: 2020-04-23T01:00:41.383162400Z
  261. 7830.7a34: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 138 ms.
  262. 7ad8.7a84: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  263. 7ad8.7a84: ChangeTime: 2020-04-23T01:09:23.871662000Z
  264. 7ad8.7a84: FileAttributes: 0x20
  265. 7ad8.7a84: Size: 0x1e8460
  266. 7ad8.7a84: NT Headers: 0xd8
  267. 7ad8.7a84: Timestamp: 0xb29ecf52
  268. 7ad8.7a84: Machine: 0x8664 - amd64
  269. 7ad8.7a84: Timestamp: 0xb29ecf52
  270. 7ad8.7a84: Image Version: 10.0
  271. 7ad8.7a84: SizeOfImage: 0x1f0000 (2031616)
  272. 7ad8.7a84: Resource Dir: 0x17f000 LB 0x6f310
  273. 7ad8.7a84: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  274. 7ad8.7a84: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  275. 7ad8.7a84: ProductName: Microsoft® Windows® Operating System
  276. 7ad8.7a84: ProductVersion: 10.0.18362.815
  277. 7ad8.7a84: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  278. 7ad8.7a84: FileDescription: NT Layer DLL
  279. 7ad8.7a84: \SystemRoot\System32\kernel32.dll:
  280. 7ad8.7a84: CreationTime: 2020-04-15T06:24:41.285620100Z
  281. 7ad8.7a84: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  282. 7ad8.7a84: ChangeTime: 2020-04-23T01:01:11.952622000Z
  283. 7ad8.7a84: FileAttributes: 0x20
  284. 7ad8.7a84: Size: 0xb0498
  285. 7ad8.7a84: NT Headers: 0xe8
  286. 7ad8.7a84: Timestamp: 0x21b07e83
  287. 7ad8.7a84: Machine: 0x8664 - amd64
  288. 7ad8.7a84: Timestamp: 0x21b07e83
  289. 7ad8.7a84: Image Version: 10.0
  290. 7ad8.7a84: SizeOfImage: 0xb2000 (729088)
  291. 7ad8.7a84: Resource Dir: 0xb0000 LB 0x520
  292. 7ad8.7a84: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  293. 7ad8.7a84: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  294. 7ad8.7a84: ProductName: Microsoft® Windows® Operating System
  295. 7ad8.7a84: ProductVersion: 10.0.18362.778
  296. 7ad8.7a84: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  297. 7ad8.7a84: FileDescription: Windows NT BASE API Client DLL
  298. 7ad8.7a84: \SystemRoot\System32\KernelBase.dll:
  299. 7ad8.7a84: CreationTime: 2020-04-23T01:00:41.758247200Z
  300. 7ad8.7a84: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  301. 7ad8.7a84: ChangeTime: 2020-04-23T01:09:23.809157500Z
  302. 7ad8.7a84: FileAttributes: 0x20
  303. 7ad8.7a84: Size: 0x2a4068
  304. 7ad8.7a84: NT Headers: 0xf8
  305. 7ad8.7a84: Timestamp: 0xb89efff3
  306. 7ad8.7a84: Machine: 0x8664 - amd64
  307. 7ad8.7a84: Timestamp: 0xb89efff3
  308. 7ad8.7a84: Image Version: 10.0
  309. 7ad8.7a84: SizeOfImage: 0x2a4000 (2768896)
  310. 7ad8.7a84: Resource Dir: 0x27e000 LB 0x548
  311. 7ad8.7a84: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  312. 7ad8.7a84: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  313. 7ad8.7a84: ProductName: Microsoft® Windows® Operating System
  314. 7ad8.7a84: ProductVersion: 10.0.18362.815
  315. 7ad8.7a84: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  316. 7ad8.7a84: FileDescription: Windows NT BASE API Client DLL
  317. 7ad8.7a84: \SystemRoot\System32\apisetschema.dll:
  318. 7ad8.7a84: CreationTime: 2019-03-19T04:43:54.837151500Z
  319. 7ad8.7a84: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  320. 7ad8.7a84: ChangeTime: 2020-04-23T01:01:11.931617700Z
  321. 7ad8.7a84: FileAttributes: 0x20
  322. 7ad8.7a84: Size: 0x1d028
  323. 7ad8.7a84: NT Headers: 0xc8
  324. 7ad8.7a84: Timestamp: 0xd6ced080
  325. 7ad8.7a84: Machine: 0x8664 - amd64
  326. 7ad8.7a84: Timestamp: 0xd6ced080
  327. 7ad8.7a84: Image Version: 10.0
  328. 7ad8.7a84: SizeOfImage: 0x1e000 (122880)
  329. 7ad8.7a84: Resource Dir: 0x1d000 LB 0x408
  330. 7ad8.7a84: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  331. 7ad8.7a84: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  332. 7ad8.7a84: ProductName: Microsoft® Windows® Operating System
  333. 7ad8.7a84: ProductVersion: 10.0.18362.1
  334. 7ad8.7a84: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  335. 7ad8.7a84: FileDescription: ApiSet Schema DLL
  336. 7ad8.7a84: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  337. 7ad8.7a84: supR3HardenedWinFindAdversaries: 0x0
  338. 7ad8.7a84: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  339. 7ad8.7a84: Calling main()
  340. 7ad8.7a84: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  341. 7ad8.7a84: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  342. 7ad8.7a84: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  343. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  344. 7ad8.7a84: SUPR3HardenedMain: Respawn #2
  345. 7ad8.7a84: supR3HardNtEnableThreadCreationEx:
  346. 7ad8.7a84: supR3HardenedDllNotificationCallback: load 00007ffbb9860000 LB 0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  347. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll)
  348. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  349. 7ad8.7a84: supR3HardenedDllNotificationCallback: load 00007ffbb9740000 LB 0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  350. 7ad8.7a84: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  351. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\sechost.dll)
  352. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\sechost.dll
  353. 7ad8.7a84: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  354. 7ad8.7a84: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ntdll.dll)
  355. 7ad8.7a84: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  356. 7ad8.7a84: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  357. 7ad8.7a84: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  358. 7ad8.7a84: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  359. 7ad8.7a84: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  360. 7ad8.7a84: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbba520000 'C:\WINDOWS\System32\ntdll.dll'
  361. 7ad8.7a84: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  362. 7ad8.7a84: supR3HardenedWinDoReSpawn(2): New child 7150.72a8 [kernel32].
  363. 7ad8.7a84: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
  364. 7ad8.7a84: supR3HardNtChildGatherData: PebBaseAddress=0000000000421000 cbPeb=0x388
  365. 7ad8.7a84: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbba520000 uNtDllChildAddr=00007ffbba520000
  366. 7ad8.7a84: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbba591770
  367. 7ad8.7a84: supR3HardenedWinSetupChildInit: Start child.
  368. 7ad8.7a84: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  369. 7ad8.7a84: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 30 sleeps
  370. 7ad8.7a84: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  371. 7ad8.7a84: *0000000000000000-000000000024ffff 0x0001/0x0000 0x0000000
  372. 7ad8.7a84: *0000000000250000-000000000026ffff 0x0004/0x0004 0x0020000
  373. 7ad8.7a84: *0000000000270000-000000000028afff 0x0002/0x0002 0x0040000
  374. 7ad8.7a84: 000000000028b000-000000000028ffff 0x0001/0x0000 0x0000000
  375. 7ad8.7a84: *0000000000290000-000000000038afff 0x0000/0x0004 0x0020000
  376. 7ad8.7a84: 000000000038b000-000000000038dfff 0x0104/0x0004 0x0020000
  377. 7ad8.7a84: 000000000038e000-000000000038ffff 0x0004/0x0004 0x0020000
  378. 7ad8.7a84: *0000000000390000-0000000000393fff 0x0002/0x0002 0x0040000
  379. 7ad8.7a84: 0000000000394000-000000000039ffff 0x0001/0x0000 0x0000000
  380. 7ad8.7a84: *00000000003a0000-00000000003a1fff 0x0004/0x0004 0x0020000
  381. 7ad8.7a84: 00000000003a2000-00000000003fffff 0x0001/0x0000 0x0000000
  382. 7ad8.7a84: *0000000000400000-0000000000420fff 0x0000/0x0004 0x0020000
  383. 7ad8.7a84: 0000000000421000-0000000000423fff 0x0004/0x0004 0x0020000
  384. 7ad8.7a84: 0000000000424000-00000000005fffff 0x0000/0x0004 0x0020000
  385. 7ad8.7a84: 0000000000600000-000000007ffdffff 0x0001/0x0000 0x0000000
  386. 7ad8.7a84: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  387. 7ad8.7a84: 000000007ffe1000-000000007ffe2fff 0x0001/0x0000 0x0000000
  388. 7ad8.7a84: *000000007ffe3000-000000007ffe3fff 0x0002/0x0002 0x0020000
  389. 7ad8.7a84: 000000007ffe4000-00007ff53e27ffff 0x0001/0x0000 0x0000000
  390. 7ad8.7a84: *00007ff53e280000-00007ff53e280fff 0x0002/0x0002 0x0040000
  391. 7ad8.7a84: 00007ff53e281000-00007ff53e28ffff 0x0001/0x0000 0x0000000
  392. 7ad8.7a84: *00007ff53e290000-00007ff53e2b2fff 0x0002/0x0002 0x0040000
  393. 7ad8.7a84: 00007ff53e2b3000-00007ff617cbffff 0x0001/0x0000 0x0000000
  394. 7ad8.7a84: *00007ff617cc0000-00007ff617cc0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  395. 7ad8.7a84: 00007ff617cc1000-00007ff617d35fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  396. 7ad8.7a84: 00007ff617d36000-00007ff617d36fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  397. 7ad8.7a84: 00007ff617d37000-00007ff617d7efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  398. 7ad8.7a84: 00007ff617d7f000-00007ff617d7ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  399. 7ad8.7a84: 00007ff617d80000-00007ff617d80fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  400. 7ad8.7a84: 00007ff617d81000-00007ff617d85fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  401. 7ad8.7a84: 00007ff617d86000-00007ff617d86fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  402. 7ad8.7a84: 00007ff617d87000-00007ff617d87fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  403. 7ad8.7a84: 00007ff617d88000-00007ff617d8bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  404. 7ad8.7a84: 00007ff617d8c000-00007ff617dd4fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  405. 7ad8.7a84: 00007ff617dd5000-00007ffbba51ffff 0x0001/0x0000 0x0000000
  406. 7ad8.7a84: *00007ffbba520000-00007ffbba520fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  407. 7ad8.7a84: 00007ffbba521000-00007ffbba637fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  408. 7ad8.7a84: 00007ffbba638000-00007ffbba67efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  409. 7ad8.7a84: 00007ffbba67f000-00007ffbba68afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  410. 7ad8.7a84: 00007ffbba68b000-00007ffbba699fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  411. 7ad8.7a84: 00007ffbba69a000-00007ffbba69afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  412. 7ad8.7a84: 00007ffbba69b000-00007ffbba69dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  413. 7ad8.7a84: 00007ffbba69e000-00007ffbba70ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
  414. 7ad8.7a84: 00007ffbba710000-00007ffffffeffff 0x0001/0x0000 0x0000000
  415. 7ad8.7a84: VBoxHeadless.exe: timestamp 0x5d9f7c37 (rc=VINF_SUCCESS)
  416. 7ad8.7a84: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  417. 7ad8.7a84: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
  418. 7ad8.7a84: supR3HardNtChildPurify: Done after 326 ms and 0 fixes (loop #0).
  419. 7150.72a8: Log file opened: 6.0.14r133895 g_hStartupLog=0000000000000008 g_uNtVerCombined=0xa047bb00
  420. 7150.72a8: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbba520000 g_uNtVerCombined=0xa047bb00
  421. 7150.72a8: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
  422. 7150.72a8: New simple heap: #1 0000000000700000 LB 0x400000 (for 2031616 allocation)
  423. 7ad8.7a84: supR3HardenedEarlyCompact: Removed heap 1 (0x00000001000000 LB 0x400000)
  424. 7ad8.7a84: supR3HardNtEnableThreadCreationEx:
  425. 7150.72a8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  426. 7150.72a8: System32: \Device\HarddiskVolume4\Windows\System32
  427. 7150.72a8: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
  428. 7150.72a8: KnownDllPath: C:\WINDOWS\System32
  429. 7150.72a8: supR3HardenedVmProcessInit: Opening vboxdrv...
  430. 7150.72a8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  431. 7150.72a8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  432. 7150.72a8: Registered Dll notification callback with NTDLL.
  433. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
  434. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  435. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  436. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb79f0000 LB 0x002a4000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  437. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
  438. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
  439. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb86e0000 LB 0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  440. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  441. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  442. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ff617cc0000 LB 0x00115000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe [fFlags=0x0]
  443. 7150.72a8: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  444. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  445. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
  446. 7150.72a8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbba591770 pvNtTerminateThread=00007ffbba5bcac0
  447. 7ad8.7a84: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 185 ms.
  448. 7150.72a8: \SystemRoot\System32\ntdll.dll:
  449. 7150.72a8: CreationTime: 2020-04-23T01:00:41.383162400Z
  450. 7150.72a8: LastWriteTime: 2020-04-23T01:00:41.418178500Z
  451. 7150.72a8: ChangeTime: 2020-04-23T01:09:23.871662000Z
  452. 7150.72a8: FileAttributes: 0x20
  453. 7150.72a8: Size: 0x1e8460
  454. 7150.72a8: NT Headers: 0xd8
  455. 7150.72a8: Timestamp: 0xb29ecf52
  456. 7150.72a8: Machine: 0x8664 - amd64
  457. 7150.72a8: Timestamp: 0xb29ecf52
  458. 7150.72a8: Image Version: 10.0
  459. 7150.72a8: SizeOfImage: 0x1f0000 (2031616)
  460. 7150.72a8: Resource Dir: 0x17f000 LB 0x6f310
  461. 7150.72a8: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  462. 7150.72a8: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  463. 7150.72a8: ProductName: Microsoft® Windows® Operating System
  464. 7150.72a8: ProductVersion: 10.0.18362.815
  465. 7150.72a8: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  466. 7150.72a8: FileDescription: NT Layer DLL
  467. 7150.72a8: \SystemRoot\System32\kernel32.dll:
  468. 7150.72a8: CreationTime: 2020-04-15T06:24:41.285620100Z
  469. 7150.72a8: LastWriteTime: 2020-04-15T06:24:41.301631600Z
  470. 7150.72a8: ChangeTime: 2020-04-23T01:01:11.952622000Z
  471. 7150.72a8: FileAttributes: 0x20
  472. 7150.72a8: Size: 0xb0498
  473. 7150.72a8: NT Headers: 0xe8
  474. 7150.72a8: Timestamp: 0x21b07e83
  475. 7150.72a8: Machine: 0x8664 - amd64
  476. 7150.72a8: Timestamp: 0x21b07e83
  477. 7150.72a8: Image Version: 10.0
  478. 7150.72a8: SizeOfImage: 0xb2000 (729088)
  479. 7150.72a8: Resource Dir: 0xb0000 LB 0x520
  480. 7150.72a8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  481. 7150.72a8: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  482. 7150.72a8: ProductName: Microsoft® Windows® Operating System
  483. 7150.72a8: ProductVersion: 10.0.18362.778
  484. 7150.72a8: FileVersion: 10.0.18362.778 (WinBuild.160101.0800)
  485. 7150.72a8: FileDescription: Windows NT BASE API Client DLL
  486. 7150.72a8: \SystemRoot\System32\KernelBase.dll:
  487. 7150.72a8: CreationTime: 2020-04-23T01:00:41.758247200Z
  488. 7150.72a8: LastWriteTime: 2020-04-23T01:00:41.816291300Z
  489. 7150.72a8: ChangeTime: 2020-04-23T01:09:23.809157500Z
  490. 7150.72a8: FileAttributes: 0x20
  491. 7150.72a8: Size: 0x2a4068
  492. 7150.72a8: NT Headers: 0xf8
  493. 7150.72a8: Timestamp: 0xb89efff3
  494. 7150.72a8: Machine: 0x8664 - amd64
  495. 7150.72a8: Timestamp: 0xb89efff3
  496. 7150.72a8: Image Version: 10.0
  497. 7150.72a8: SizeOfImage: 0x2a4000 (2768896)
  498. 7150.72a8: Resource Dir: 0x27e000 LB 0x548
  499. 7150.72a8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  500. 7150.72a8: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  501. 7150.72a8: ProductName: Microsoft® Windows® Operating System
  502. 7150.72a8: ProductVersion: 10.0.18362.815
  503. 7150.72a8: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
  504. 7150.72a8: FileDescription: Windows NT BASE API Client DLL
  505. 7150.72a8: \SystemRoot\System32\apisetschema.dll:
  506. 7150.72a8: CreationTime: 2019-03-19T04:43:54.837151500Z
  507. 7150.72a8: LastWriteTime: 2019-03-19T04:43:54.837151500Z
  508. 7150.72a8: ChangeTime: 2020-04-23T01:01:11.931617700Z
  509. 7150.72a8: FileAttributes: 0x20
  510. 7150.72a8: Size: 0x1d028
  511. 7150.72a8: NT Headers: 0xc8
  512. 7150.72a8: Timestamp: 0xd6ced080
  513. 7150.72a8: Machine: 0x8664 - amd64
  514. 7150.72a8: Timestamp: 0xd6ced080
  515. 7150.72a8: Image Version: 10.0
  516. 7150.72a8: SizeOfImage: 0x1e000 (122880)
  517. 7150.72a8: Resource Dir: 0x1d000 LB 0x408
  518. 7150.72a8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  519. 7150.72a8: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  520. 7150.72a8: ProductName: Microsoft® Windows® Operating System
  521. 7150.72a8: ProductVersion: 10.0.18362.1
  522. 7150.72a8: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
  523. 7150.72a8: FileDescription: ApiSet Schema DLL
  524. 7150.72a8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  525. 7150.72a8: supR3HardenedWinFindAdversaries: 0x0
  526. 7150.72a8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  527. 7150.72a8: Calling main()
  528. 7150.72a8: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
  529. 7150.72a8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox'
  530. 7150.72a8: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
  531. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
  532. 7150.72a8: SUPR3HardenedMain: Final process, opening VBoxDrv...
  533. 7150.72a8: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000700000 LB 0x400000)
  534. 7150.72a8: supR3HardNtEnableThreadCreationEx:
  535. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  536. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  537. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  538. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  539. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbaa3a0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  540. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  541. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  542. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  543. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  544. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  545. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  546. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  547. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa3a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  548. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  549. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msasn1.dll'.
  550. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  551. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  552. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wintrust.dll)
  553. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wintrust.dll
  554. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  555. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  556. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll)
  557. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  558. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  559. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume4\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  560. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msasn1.dll'.
  561. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\crypt32.dll)
  562. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  563. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  564. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume4\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  565. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msasn1.dll)
  566. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msasn1.dll
  567. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  568. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  569. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msvcrt.dll)
  570. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  571. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  572. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume4\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  573. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  574. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  575. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8cf0000 LB 0x0009e000 C:\WINDOWS\System32\msvcrt.dll [fFlags=0x0]
  576. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  577. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7460000 LB 0x00012000 C:\WINDOWS\System32\MSASN1.dll [fFlags=0x0]
  578. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  579. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7680000 LB 0x000fa000 C:\WINDOWS\System32\ucrtbase.dll [fFlags=0x0]
  580. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ucrtbase.dll)
  581. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ucrtbase.dll
  582. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8480000 LB 0x00149000 C:\WINDOWS\System32\CRYPT32.dll [fFlags=0x0]
  583. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  584. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb9860000 LB 0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  585. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  586. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7ca0000 LB 0x0005c000 C:\WINDOWS\System32\Wintrust.dll [fFlags=0x0]
  587. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  588. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  589. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  590. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  591. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  592. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  593. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  594. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  595. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  596. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  597. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  598. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  599. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  600. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  601. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  602. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-1'
  603. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\system32\Wintrust.dll'
  604. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\bcrypt.dll)
  605. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  606. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  607. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7650000 LB 0x00026000 C:\WINDOWS\System32\bcrypt.dll [fFlags=0x0]
  608. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  609. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7650000 'C:\WINDOWS\system32\bcrypt.dll'
  610. 7150.72a8: bcrypt.dll loaded at 00007ffbb7650000, BCryptOpenAlgorithmProvider at 00007ffbb7654c70, preloading providers:
  611. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll)
  612. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll
  613. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  614. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7850000 LB 0x00080000 C:\WINDOWS\System32\bcryptprimitives.dll [fFlags=0x0]
  615. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  616. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7850000 'C:\WINDOWS\system32\bcryptprimitives.dll'
  617. 7150.72a8: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=0000000000bed6b0)
  618. 7150.72a8: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=0000000000beec20)
  619. 7150.72a8: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=0000000000beef20)
  620. 7150.72a8: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=0000000000bef220)
  621. 7150.72a8: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=0000000000bef520)
  622. 7150.72a8: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=0000000000bef820)
  623. 7150.72a8: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=0000000000befb90)
  624. 7150.72a8: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=0000000000befe90)
  625. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb78d0000 LB 0x00017000 C:\WINDOWS\System32\CRYPTSP.dll [fFlags=0x0]
  626. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cryptsp.dll)
  627. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptsp.dll
  628. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
  629. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\rsaenh.dll)
  630. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  631. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  632. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  633. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  634. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  635. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  636. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb67c0000 LB 0x00033000 C:\WINDOWS\system32\rsaenh.dll [fFlags=0x0]
  637. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  638. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  639. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
  640. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cryptbase.dll)
  641. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptbase.dll
  642. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb6e20000 LB 0x0000c000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
  643. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  644. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  645. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  646. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  647. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  648. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  649. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\kernel32.dll'
  650. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  651. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  652. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\System32\WINTRUST.DLL'
  653. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  654. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  655. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\CRYPT32.dll'
  656. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb9980000 LB 0x0001d000 C:\WINDOWS\System32\imagehlp.dll [fFlags=0x0]
  657. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'rpcrt4.dll'.
  658. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\imagehlp.dll)
  659. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\imagehlp.dll
  660. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  661. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  662. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  663. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  664. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  665. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  666. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb9740000 LB 0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  667. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  668. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\sechost.dll)
  669. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\sechost.dll
  670. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  671. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  672. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gpapi.dll)
  673. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gpapi.dll
  674. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb6000000 LB 0x00022000 C:\WINDOWS\SYSTEM32\gpapi.dll [fFlags=0x0]
  675. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  676. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7480000 LB 0x00023000 C:\WINDOWS\System32\profapi.dll [fFlags=0x0]
  677. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\profapi.dll)
  678. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\profapi.dll
  679. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  680. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
  681. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\cryptnet.dll)
  682. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cryptnet.dll
  683. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  684. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume4\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  685. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  686. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  687. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  688. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  689. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  690. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  691. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  692. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  693. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  694. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  695. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  696. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  697. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  698. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  699. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  700. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb19e0000 LB 0x0002f000 C:\WINDOWS\System32\cryptnet.dll [fFlags=0x0]
  701. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  702. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  703. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  704. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  705. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  706. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  707. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  708. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  709. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  710. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  711. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  712. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  713. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  714. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  715. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  716. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  717. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  718. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  719. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  720. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  721. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  722. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  723. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  724. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  725. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  726. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  727. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  728. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  729. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  730. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\WINDOWS\System32\cryptnet.dll'
  731. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  732. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb19e0000 'C:\Windows\System32\cryptnet.dll'
  733. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8be0000 LB 0x000a3000 C:\WINDOWS\System32\advapi32.dll [fFlags=0x0]
  734. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  735. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
  736. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  737. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\advapi32.dll)
  738. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  739. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  740. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  741. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  742. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  743. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
  744. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume4\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
  745. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  746. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  747. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  748. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  749. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  750. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  751. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  752. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  753. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  754. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  755. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: New context 0000000000c43850
  756. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  757. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2F110B40CF67FEF4EFA84C23431B3B42233E381F
  758. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  759. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  760. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9860000 'C:\WINDOWS\System32\rpcrt4.dll'
  761. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  762. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  763. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  764. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  765. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  766. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  767. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.815.cat'; file='\SystemRoot\System32\ntdll.dll'
  768. 7150.72a8: g_pfnWinVerifyTrust=00007ffbb7ca61f0
  769. 7150.72a8: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  770. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  771. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  772. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  773. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  774. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  775. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  776. 7150.72a8: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\crypt32.dll'
  777. 7150.72a8: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  778. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  779. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  780. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  781. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  782. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  783. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  784. 7150.72a8: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\wintrust.dll'
  785. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  786. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  787. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  788. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  789. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\advapi32.dll'
  790. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b0 pwszName=\Device\HarddiskVolume4\Windows\System32\cryptnet.dll
  791. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  792. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  793. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09032EBC3D9D9BDDC0EE4A6463C043296B79FF20
  794. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  795. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  796. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  797. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.815.cat'; file='\Device\HarddiskVolume4\Windows\System32\cryptnet.dll'
  798. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  799. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptnet.dll'
  800. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  801. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  802. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  803. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\profapi.dll'
  804. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  805. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  806. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  807. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\gpapi.dll'
  808. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  809. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  810. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  811. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\sechost.dll'
  812. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  813. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  814. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  815. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\imagehlp.dll'
  816. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  817. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  818. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  819. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptbase.dll'
  820. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  821. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  822. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  823. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  824. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  825. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\rsaenh.dll'
  826. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  827. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  828. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  829. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  830. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cryptsp.dll'
  831. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  832. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  833. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll'
  834. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  835. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  836. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll'
  837. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  838. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  839. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\ucrtbase.dll'
  840. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  841. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  842. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll'
  843. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  844. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  845. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msasn1.dll'
  846. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  847. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  848. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll'
  849. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  850. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  851. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  852. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.exe'
  853. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  854. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  855. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\KernelBase.dll'
  856. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  857. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  858. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\kernel32.dll'
  859. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\system32\crypt32.dll'
  860. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  861. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  862. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  863. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
  864. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  865. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  866. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  867. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
  868. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  869. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  870. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
  871. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root Certificate Authority 2014
  872. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xa12b07674f1bf600 C=US, O=AffirmTrust, CN=AffirmTrust Commercial
  873. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
  874. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  875. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x50bb81640c01cb00 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  876. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  877. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  878. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  879. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  880. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  881. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  882. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  883. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  884. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  885. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xd944bca189a00 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
  886. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  887. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  888. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  889. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  890. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  891. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  892. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  893. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
  894. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  895. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xbebef0d2217f0bfb C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3
  896. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  897. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  898. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, [email protected]
  899. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  900. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  901. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x665014bdbcc8f800 O=Cybertrust, Inc, CN=Cybertrust Global Root
  902. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xb352b1523915d000 C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2
  903. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  904. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x73e85f1bda5faa00 C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2
  905. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
  906. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  907. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  908. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  909. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  910. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  911. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  912. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  913. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
  914. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  915. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
  916. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xdc1801b225aea100 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3
  917. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  918. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  919. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  920. 7150.72a8: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  921. 7150.72a8: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=61
  922. 7150.72a8: SUPR3HardenedMain: Load Runtime...
  923. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  924. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  925. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  926. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  927. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  928. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  929. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  930. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  931. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  932. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  933. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  934. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  935. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ws2_32.dll) WinVerifyTrust
  936. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  937. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  938. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  939. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  940. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  941. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  942. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  943. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  944. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  945. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  946. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  947. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  948. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  949. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  950. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  951. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  952. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  953. 7150.72a8: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  954. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll)
  955. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  956. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  957. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  958. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  959. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  960. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  961. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  962. 7150.72a8: supR3HardenedDllNotificationCallback: load 0000000053db0000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  963. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  964. 7150.72a8: supR3HardenedDllNotificationCallback: load 0000000053d10000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  965. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  966. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb97f0000 LB 0x0006f000 C:\WINDOWS\System32\WS2_32.dll [fFlags=0x0]
  967. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  968. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffb5fef0000 LB 0x005e2000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  969. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  970. 7150.72a8: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  971. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  972. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  973. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  974. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  975. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  976. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  977. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  978. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  979. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  980. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  981. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  982. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  983. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  984. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  985. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  986. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  987. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  988. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  989. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  990. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  991. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  992. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  993. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  994. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  995. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  996. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  997. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  998. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  999. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1000. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1001. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1002. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1003. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1004. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1005. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1006. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1007. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1008. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1009. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1010. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1011. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1012. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1013. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1014. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1015. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1016. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1017. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1018. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1019. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1020. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb5fef0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1021. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wintrust.dll
  1022. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1023. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb7ca0000 'C:\WINDOWS\system32\Wintrust.dll'
  1024. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1025. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1026. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  1027. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1028. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1029. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1030. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\system32\crypt32.dll'
  1031. 7150.72a8: SUPR3HardenedMain: Load TrustedMain...
  1032. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1033. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1034. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  1035. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
  1036. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  1037. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1038. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
  1039. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1040. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll) WinVerifyTrust
  1041. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1042. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1043. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1044. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1045. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1046. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1047. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
  1048. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\user32.dll) WinVerifyTrust
  1049. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\user32.dll
  1050. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1051. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1052. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1053. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1054. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1055. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1056. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1057. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1058. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1059. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1060. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1061. 7150.72a8: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1062. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'win32u.dll'.
  1063. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gdi32.dll)
  1064. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1065. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1066. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1067. 7150.72a8: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1068. 7150.72a8: '\Device\HarddiskVolume4\Windows\System32\win32u.dll' has no imports
  1069. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\win32u.dll)
  1070. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1071. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1072. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1073. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1074. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1075. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\crypt32.dll
  1076. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1077. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1078. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1079. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
  1080. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  1081. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\oleaut32.dll) WinVerifyTrust
  1082. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1083. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1084. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1085. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1086. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1087. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1088. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1089. 7150.72a8: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\combase.dll'.
  1090. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1091. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'bcryptprimitives.dll'.
  1092. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\combase.dll)
  1093. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\combase.dll
  1094. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1095. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1096. 7150.72a8: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1097. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll)
  1098. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll
  1099. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  1100. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  1101. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcryptprimitives.dll
  1102. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1103. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1104. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1105. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1106. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
  1107. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'gdi32.dll'.
  1108. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'user32.dll'.
  1109. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #58 'combase.dll'.
  1110. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\ole32.dll) WinVerifyTrust
  1111. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1112. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1113. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1114. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll [redoing WinVerifyTrust]
  1115. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1116. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1117. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1118. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1119. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1120. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1121. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1122. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1123. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1124. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1125. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1126. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1127. 7150.72a8: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll'
  1128. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  1129. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1130. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8dd0000 LB 0x00336000 C:\WINDOWS\System32\combase.dll [fFlags=0x0]
  1131. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [avoiding WinVerifyTrust]
  1132. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb7780000 LB 0x00021000 C:\WINDOWS\System32\win32u.dll [fFlags=0x0]
  1133. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
  1134. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb77b0000 LB 0x0009e000 C:\WINDOWS\System32\msvcp_win.dll [fFlags=0x0]
  1135. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
  1136. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbba2c0000 LB 0x00194000 C:\WINDOWS\System32\USER32.dll [fFlags=0x0]
  1137. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1138. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb74b0000 LB 0x00194000 C:\WINDOWS\System32\gdi32full.dll [fFlags=0x0]
  1139. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1140. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1141. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'user32.dll'.
  1142. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'win32u.dll'.
  1143. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\gdi32full.dll)
  1144. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\gdi32full.dll
  1145. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8da0000 LB 0x00026000 C:\WINDOWS\System32\GDI32.dll [fFlags=0x0]
  1146. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
  1147. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb88e0000 LB 0x00157000 C:\WINDOWS\System32\ole32.dll [fFlags=0x0]
  1148. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1149. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8a40000 LB 0x000c4000 C:\WINDOWS\System32\OLEAUT32.dll [fFlags=0x0]
  1150. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1151. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba0a30000 LB 0x00052000 C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll [fFlags=0x0]
  1152. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxHeadless.dll
  1153. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32full.dll'.
  1154. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\gdi32full.dll' [rescheduled]
  1155. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1156. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rescheduled]
  1157. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\combase.dll'.
  1158. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rescheduled]
  1159. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1160. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rescheduled]
  1161. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1162. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rescheduled]
  1163. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll
  1164. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1165. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1166. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1167. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1168. 7150.72a8: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1169. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1170. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1171. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1172. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1173. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1174. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1175. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'.
  1176. 7150.72a8: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1177. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1178. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1179. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  1180. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll'.
  1181. 7150.72a8: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll
  1182. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1183. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb86e0000 'C:\WINDOWS\System32\kernel32.dll'
  1184. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  1185. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1186. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-string-l1-1-0'
  1187. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  1188. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1189. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-datetime-l1-1-1'
  1190. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  1191. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1192. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-obsolete-l1-2-0'
  1193. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\imm32.dll'.
  1194. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1195. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
  1196. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\imm32.dll)
  1197. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\imm32.dll
  1198. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1199. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume4\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1200. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1201. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\win32u.dll'.
  1202. 7150.72a8: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume4\Windows\System32\win32u.dll
  1203. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1204. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1205. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1206. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1207. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb9b30000 LB 0x0002e000 C:\WINDOWS\System32\IMM32.DLL [fFlags=0x0]
  1208. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
  1209. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9b30000 'C:\WINDOWS\system32\IMM32.DLL'
  1210. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\imm32.dll'.
  1211. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\imm32.dll' [rescheduled]
  1212. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba0a30000 'C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll'
  1213. 7150.72a8: SUPR3HardenedMain: Calling TrustedMain (00007ffba0a32d70)...
  1214. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb73f0000 LB 0x00011000 C:\WINDOWS\System32\kernel.appcore.dll [fFlags=0x0]
  1215. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
  1216. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  1217. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll)
  1218. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll
  1219. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb9a80000 LB 0x000a2000 C:\WINDOWS\System32\clbcatq.dll [fFlags=0x0]
  1220. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1221. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
  1222. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\clbcatq.dll)
  1223. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\clbcatq.dll
  1224. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1225. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1226. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1227. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1228. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1229. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1230. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1231. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1232. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1233. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1234. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1235. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1236. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\clbcatq.dll'
  1237. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1238. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1239. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\kernel.appcore.dll'
  1240. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1241. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1242. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1243. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1244. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1245. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1246. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1247. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
  1248. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1249. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1250. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1251. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1252. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1253. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1254. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1255. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1256. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1257. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1258. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1259. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1260. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1261. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1262. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1263. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1264. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1265. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1266. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1267. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1268. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffb68080000 LB 0x003a4000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  1269. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1270. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb68080000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  1271. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1272. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1273. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1274. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1275. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
  1276. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1277. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1278. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1279. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
  1280. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1281. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1282. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1283. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1284. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1285. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1286. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1287. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1288. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1289. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1290. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1291. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1292. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1293. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1294. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'gdi32.dll'.
  1295. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'user32.dll'.
  1296. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\shlwapi.dll) WinVerifyTrust
  1297. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\shlwapi.dll
  1298. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1299. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1300. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1301. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1302. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1303. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1304. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1305. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1306. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1307. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1308. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1309. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1310. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1311. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1312. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1313. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1314. 7150.72a8: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\gdi32.dll'
  1315. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1316. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1317. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1318. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1319. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1320. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb8c90000 LB 0x00052000 C:\WINDOWS\System32\SHLWAPI.dll [fFlags=0x0]
  1321. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\shlwapi.dll
  1322. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffb9e730000 LB 0x000d5000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
  1323. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1324. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb9e730000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
  1325. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1326. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1327. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8a40000 'C:\Windows\System32\oleaut32.dll'
  1328. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1329. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1330. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb88e0000 'C:\WINDOWS\System32\ole32.dll'
  1331. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1332. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\OLEAUT32.dll (Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1333. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8a40000 'C:\WINDOWS\System32\OLEAUT32.dll'
  1334. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007c4 pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1335. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1336. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1337. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DB1AA7E2E4704C908EC9382E1F9E64808B9E5E1D
  1338. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1339. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1340. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll'
  1341. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1342. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1343. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1344. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
  1345. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
  1346. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1347. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  1348. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  1349. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007c0 pwszName=\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1350. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1351. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1352. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=22EAF38FA276D7A374D3945ACD556FA0953D3440
  1353. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1354. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1355. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll'
  1356. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1357. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1358. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'bcrypt.dll'.
  1359. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'ws2_32.dll'.
  1360. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll) WinVerifyTrust
  1361. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1362. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1363. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1364. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1365. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1366. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1367. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1368. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1369. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1370. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1371. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1372. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1373. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  1374. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1375. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1376. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1377. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1378. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1379. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba9870000 LB 0x00084000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [fFlags=0x0]
  1380. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1381. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbaa580000 LB 0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [fFlags=0x0]
  1382. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemprox.dll
  1383. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
  1384. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1385. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  1386. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa580000 'C:\WINDOWS\system32\wbem\wbemprox.dll'
  1387. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000768 pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1388. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1389. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1390. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=00C864D7F76A7AD25E7D0DA164B0B66188F5B7FF
  1391. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1392. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1393. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll'
  1394. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1395. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1396. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  1397. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
  1398. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1399. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1400. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1401. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rpcrt4.dll
  1402. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1403. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1404. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1405. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1406. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba9200000 LB 0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [fFlags=0x0]
  1407. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\wbemsvc.dll
  1408. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9200000 'C:\WINDOWS\system32\wbem\wbemsvc.dll'
  1409. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
  1410. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1411. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-0.dll'
  1412. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
  1413. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1414. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
  1415. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007e4 pwszName=\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1416. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1417. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1418. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0708A64F48237CD4D5092546CE9C373F20B30CA1
  1419. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1420. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1421. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.752.cat'; file='\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll'
  1422. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1423. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1424. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'wbemcomn.dll'.
  1425. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
  1426. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1427. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  1428. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume4\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  1429. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbemcomn.dll
  1430. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1431. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1432. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1433. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1434. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba9220000 LB 0x00101000 C:\WINDOWS\system32\wbem\fastprox.dll [fFlags=0x0]
  1435. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\wbem\fastprox.dll
  1436. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9220000 'C:\WINDOWS\system32\wbem\fastprox.dll'
  1437. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001d8 pwszName=\Device\HarddiskVolume4\Windows\System32\amsi.dll
  1438. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1439. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1440. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B5D4D58A583ACAD5AA76D7DD0F2DB8ADE903942B
  1441. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1442. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1443. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.18362.720.cat'; file='\Device\HarddiskVolume4\Windows\System32\amsi.dll'
  1444. 7150.72a8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1445. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1446. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  1447. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'userenv.dll'.
  1448. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\amsi.dll) WinVerifyTrust
  1449. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1450. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'userenv.dll'...
  1451. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' -> '\Device\HarddiskVolume4\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
  1452. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1453. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1454. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  1455. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'profapi.dll'.
  1456. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\userenv.dll) WinVerifyTrust
  1457. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1458. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1459. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1460. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1461. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1462. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1463. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1464. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\profapi.dll
  1465. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1466. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1467. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\amsi.dll (Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1468. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1469. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1470. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb72d0000 LB 0x00025000 C:\WINDOWS\SYSTEM32\USERENV.dll [fFlags=0x0]
  1471. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\userenv.dll
  1472. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba67a0000 LB 0x00015000 C:\WINDOWS\System32\amsi.dll [fFlags=0x0]
  1473. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\amsi.dll
  1474. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba67a0000 'C:\WINDOWS\System32\amsi.dll'
  1475. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1476. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1477. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'oleaut32.dll'.
  1478. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  1479. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1480. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll) WinVerifyTrust
  1481. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1482. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1483. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1484. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1485. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1486. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1487. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1488. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1489. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1490. 7150.72a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1491. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1492. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1493. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffba6750000 LB 0x00046000 C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll [fFlags=0x0]
  1494. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2003.8-0\MpOAV.dll
  1495. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1496. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1497. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  1498. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1499. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1500. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  1501. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1502. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1503. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-synch-l1-2-0'
  1504. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1505. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1506. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-fibers-l1-1-1'
  1507. 7150.72a8: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  1508. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1509. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb79f0000 'api-ms-win-core-localization-l1-2-1'
  1510. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\version.dll'.
  1511. 7150.72a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1512. 7150.72a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\version.dll)
  1513. 7150.72a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\version.dll
  1514. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1515. 7150.72a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1516. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\version.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1517. 7150.72a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\version.dll [avoiding WinVerifyTrust]
  1518. 7150.72a8: supR3HardenedDllNotificationCallback: load 00007ffbb1a20000 LB 0x0000a000 C:\WINDOWS\system32\version.dll [fFlags=0x0]
  1519. 7150.72a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\version.dll [avoiding WinVerifyTrust]
  1520. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb1a20000 'C:\WINDOWS\system32\version.dll'
  1521. 7150.72a8: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume4\Windows\System32\version.dll'.
  1522. 7150.72a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume4\Windows\System32\version.dll' [rescheduled]
  1523. 7150.72a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba6750000 'C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpOav.dll'
  1524. 7150.3d88: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1525. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1526. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrem.dll'.
  1527. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1528. 7150.3d88: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
  1529. 7150.3d88: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1530. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1531. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1532. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrem.dll'...
  1533. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrem.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrem.dll' [rcNtRedir=0xc0150008]
  1534. 7150.3d88: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1535. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
  1536. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1537. 7150.3d88: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcrt.dll'.
  1538. 7150.3d88: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll) WinVerifyTrust
  1539. 7150.3d88: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1540. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1541. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1542. 7150.3d88: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1543. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1544. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1545. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1546. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1547. 7150.3d88: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1548. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1549. 7150.3d88: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1550. 7150.3d88: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1551. 7150.3d88: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1552. 7150.3d88: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1553. 7150.3d88: supR3HardenedDllNotificationCallback: load 0000000053c00000 LB 0x0010b000 C:\Program Files\Oracle\VirtualBox\VBoxREM.dll [fFlags=0x0]
  1554. 7150.3d88: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxREM.dll
  1555. 7150.3d88: supR3HardenedDllNotificationCallback: load 00007ffb6c740000 LB 0x00331000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
  1556. 7150.3d88: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1557. 7150.3d88: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb6c740000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  1558. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1559. 7150.6738: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1560. 7150.6738: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1561. 7150.6738: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1562. 7150.6738: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1563. 7150.6738: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1564. 7150.6738: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
  1565. 7150.6738: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1566. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1567. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1568. 7150.6738: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1569. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1570. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1571. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1572. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1573. 7150.6738: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1574. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1575. 7150.6738: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1576. 7150.6738: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1577. 7150.6738: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1578. 7150.6738: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1579. 7150.6738: supR3HardenedDllNotificationCallback: load 00007ffbaa380000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
  1580. 7150.6738: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  1581. 7150.6738: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbaa380000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
  1582. 7150.6738: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1583. 7150.6738: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\User32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1584. 7150.6738: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbba2c0000 'C:\WINDOWS\system32\User32.dll'
  1585. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000008d4 pwszName=\Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1586. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000000c43850
  1587. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000000c43850
  1588. 7150.b60: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1589. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=286AD1CEC16EFDCA5718925D19E68A486A5851A0
  1590. 7150.11eec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1591. 7150.11eec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1592. 7150.b60: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1593. 7150.b60: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1594. 7150.b60: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1595. 7150.b60: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
  1596. 7150.b60: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1597. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1598. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1599. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1600. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1601. 7150.b60: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1602. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1603. 7150.b60: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1604. 7150.b60: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll
  1605. 7150.b60: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1606. 7150.b60: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1607. 7150.b60: supR3HardenedDllNotificationCallback: load 00007ffba9020000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
  1608. 7150.b60: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  1609. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0415~31bf3856ad364e35~amd64~~10.0.18362.720.cat'; file='\Device\HarddiskVolume4\Windows\System32\uxtheme.dll'
  1610. 7150.b60: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9020000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
  1611. 7150.11eec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1612. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1613. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1614. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
  1615. 7150.11eec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\uxtheme.dll) WinVerifyTrust
  1616. 7150.11eec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1617. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1618. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1619. 7150.11eec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\user32.dll
  1620. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1621. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1622. 7150.11eec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1623. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1624. 7150.11eec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1625. 7150.11eec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1626. 7150.11eec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1627. 7150.11eec: supR3HardenedDllNotificationCallback: load 00007ffbb56c0000 LB 0x00099000 C:\WINDOWS\system32\uxtheme.dll [fFlags=0x0]
  1628. 7150.11eec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\uxtheme.dll
  1629. 7150.11eec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb56c0000 'C:\WINDOWS\system32\uxtheme.dll'
  1630. 7150.11eec: supR3HardenedDllNotificationCallback: load 00007ffbb87a0000 LB 0x00136000 C:\WINDOWS\System32\MSCTF.dll [fFlags=0x0]
  1631. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1632. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'oleaut32.dll'.
  1633. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'user32.dll'.
  1634. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'gdi32.dll'.
  1635. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'imm32.dll'.
  1636. 7150.11eec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'advapi32.dll'.
  1637. 7150.11eec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\msctf.dll)
  1638. 7150.11eec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\msctf.dll
  1639. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1640. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1641. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1642. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1643. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume4\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1644. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1645. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1646. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1647. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1648. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1649. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1650. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1651. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume4\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1652. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\oleaut32.dll
  1653. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1654. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1655. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcrt.dll
  1656. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1657. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1658. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #77 'user32.dll'.
  1659. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #79 'gdi32.dll'.
  1660. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\shell32.dll) WinVerifyTrust
  1661. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\shell32.dll
  1662. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1663. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1664. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\gdi32.dll
  1665. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1666. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1667. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1668. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb78f0000 LB 0x0004a000 C:\WINDOWS\System32\cfgmgr32.dll [fFlags=0x0]
  1669. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll)
  1670. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll
  1671. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb85d0000 LB 0x000a9000 C:\WINDOWS\System32\shcore.dll [fFlags=0x0]
  1672. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1673. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'rpcrt4.dll'.
  1674. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
  1675. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\SHCore.dll)
  1676. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\SHCore.dll
  1677. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb73e0000 LB 0x00010000 C:\WINDOWS\System32\UMPDC.dll [fFlags=0x0]
  1678. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\umpdc.dll)
  1679. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\umpdc.dll
  1680. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb7410000 LB 0x0004a000 C:\WINDOWS\System32\powrprof.dll [fFlags=0x0]
  1681. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  1682. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'umpdc.dll'.
  1683. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\powrprof.dll)
  1684. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\powrprof.dll
  1685. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb7d00000 LB 0x0077d000 C:\WINDOWS\System32\windows.storage.dll [fFlags=0x0]
  1686. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
  1687. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
  1688. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'rpcrt4.dll'.
  1689. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'profapi.dll'.
  1690. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\windows.storage.dll)
  1691. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\windows.storage.dll
  1692. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb9b60000 LB 0x006e4000 C:\WINDOWS\System32\Shell32.dll [fFlags=0x0]
  1693. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\shell32.dll
  1694. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb9b60000 'C:\WINDOWS\system32\Shell32.dll'
  1695. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1696. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1697. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\profapi.dll
  1698. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1699. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1700. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1701. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1702. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\msvcp_win.dll [lacks WinVerifyTrust]
  1703. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1704. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1705. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1706. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'umpdc.dll'...
  1707. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'umpdc.dll' -> '\Device\HarddiskVolume4\Windows\System32\umpdc.dll' [rcNtRedir=0xc0150008]
  1708. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\umpdc.dll [lacks WinVerifyTrust]
  1709. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1710. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1711. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1712. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume4\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1713. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1714. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1715. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1716. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1717. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1718. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1719. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1720. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\windows.storage.dll'
  1721. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1722. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1723. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\powrprof.dll'
  1724. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1725. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1726. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\umpdc.dll'
  1727. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1728. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1729. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\SHCore.dll'
  1730. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1731. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1732. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll'
  1733. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1734. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1735. 7150.65a8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume4\Windows\System32\msctf.dll'
  1736. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\rsaenh.dll
  1737. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1738. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1739. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1740. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1741. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1742. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1743. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
  1744. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
  1745. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1746. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  1747. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
  1748. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
  1749. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
  1750. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
  1751. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1752. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  1753. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  1754. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1755. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1756. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
  1757. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1758. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1759. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1760. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ole32.dll
  1761. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1762. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume4\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1763. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\ws2_32.dll
  1764. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1765. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1766. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1767. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb8480000 'C:\WINDOWS\System32\crypt32.dll'
  1768. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1769. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
  1770. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'cfgmgr32.dll'.
  1771. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'bcrypt.dll'.
  1772. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\setupapi.dll) WinVerifyTrust
  1773. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1774. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1775. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1776. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
  1777. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
  1778. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1779. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume4\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1780. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\bcrypt.dll
  1781. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1782. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1783. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\cfgmgr32.dll
  1784. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1785. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume4\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1786. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1787. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume4\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1788. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1789. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1790. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1791. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
  1792. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1793. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
  1794. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
  1795. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1796. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1797. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1798. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1799. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1800. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1801. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1802. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1803. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
  1804. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  1805. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
  1806. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1807. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1808. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1809. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1810. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1811. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1812. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1813. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1814. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1815. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume4\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1816. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\advapi32.dll
  1817. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  1818. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume4\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  1819. 7150.65a8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1820. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1821. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume4\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1822. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1823. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1824. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1825. 7150.65a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1826. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1827. 7150.65a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1828. 7150.65a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1829. 7150.65a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1830. 7150.65a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1831. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb9110000 LB 0x00470000 C:\WINDOWS\System32\SETUPAPI.dll [fFlags=0x0]
  1832. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\setupapi.dll
  1833. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffba6240000 LB 0x00064000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
  1834. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  1835. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffb9f060000 LB 0x0005c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
  1836. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1837. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb6960000 LB 0x0003a000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
  1838. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1839. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffb50590000 LB 0x009da000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
  1840. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD.dll
  1841. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb50590000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
  1842. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1843. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxC.dll
  1844. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1845. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb68080000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
  1846. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1847. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  1848. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1849. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffb9f060000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
  1850. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1851. 7150.3680: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1852. 7150.3680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1853. 7150.3680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  1854. 7150.3680: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1855. 7150.3680: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
  1856. 7150.3680: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1857. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1858. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1859. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1860. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1861. 7150.3680: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1862. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1863. 7150.3680: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1864. 7150.3680: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1865. 7150.3680: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1866. 7150.3680: supR3HardenedDllNotificationCallback: load 00007ffba9000000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
  1867. 7150.3680: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  1868. 7150.3680: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba9000000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
  1869. 7150.5c8c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1870. 7150.5c8c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1871. 7150.5c8c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1872. 7150.5c8c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  1873. 7150.5c8c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  1874. 7150.5c8c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
  1875. 7150.5c8c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1876. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1877. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1878. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  1879. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  1880. 7150.5c8c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  1881. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1882. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1883. 7150.5c8c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1884. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1885. 7150.5c8c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1886. 7150.5c8c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1887. 7150.5c8c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1888. 7150.5c8c: supR3HardenedDllNotificationCallback: load 00007ffba8c50000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
  1889. 7150.5c8c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  1890. 7150.5c8c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba8c50000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
  1891. 7150.17cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb67c0000 'C:\WINDOWS\system32\rsaenh.dll'
  1892. 7150.17cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1893. 7150.17cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1894. 7150.17cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1895. 7150.17cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
  1896. 7150.17cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1897. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1898. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1899. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1900. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1901. 7150.17cc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcp100.dll
  1902. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1903. 7150.17cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1904. 7150.17cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1905. 7150.17cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1906. 7150.17cc: supR3HardenedDllNotificationCallback: load 00007ffba8c40000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
  1907. 7150.17cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  1908. 7150.17cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffba8c40000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
  1909. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\IPHLPAPI.DLL
  1910. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Iphlpapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1911. 7150.65a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbb6960000 'C:\WINDOWS\system32\Iphlpapi.dll'
  1912. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1913. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
  1914. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\winnsi.dll)
  1915. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\winnsi.dll
  1916. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb8d90000 LB 0x00008000 C:\WINDOWS\System32\NSI.dll [fFlags=0x0]
  1917. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\nsi.dll)
  1918. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\nsi.dll
  1919. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb1a10000 LB 0x0000b000 C:\WINDOWS\SYSTEM32\WINNSI.DLL [fFlags=0x0]
  1920. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
  1921. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1922. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll)
  1923. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll
  1924. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb19c0000 LB 0x00016000 C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL [fFlags=0x0]
  1925. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\dhcpcsvc6.dll [avoiding WinVerifyTrust]
  1926. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1927. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
  1928. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'nsi.dll'.
  1929. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll)
  1930. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll
  1931. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb1840000 LB 0x0001c000 C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL [fFlags=0x0]
  1932. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume4\Windows\System32\dhcpcsvc.dll [avoiding WinVerifyTrust]
  1933. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'ws2_32.dll'.
  1934. 7150.65a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'nsi.dll'.
  1935. 7150.65a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\dnsapi.dll)
  1936. 7150.65a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\dnsapi.dll
  1937. 7150.65a8: supR3HardenedDllNotificationCallback: load 00007ffbb69a0000 LB 0x000cb000 C:\WINDOWS\SYSTEM32\DNSAPI.dll [fFlags=0x0]
  1938. 7150.65a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\dnsapi.dll [avoiding WinVerifyTrust]
  1939. 7ad8.7a84: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 395854 ms, the end);
  1940. 7830.7a34: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 396488 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!