API tools faq
paste
Guest User

Untitled

a guest
Feb 18th, 2018
154
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 354.48 KB | None | 0 0
raw download clone embed print report
  1. 1b14.205c: Log file opened: 5.2.6r120293 g_hStartupLog=0000000000000068 g_uNtVerCombined=0xa03fab00
  2. 1b14.205c: \SystemRoot\System32\ntdll.dll:
  3. 1b14.205c: CreationTime: 2018-02-14T09:40:22.763350100Z
  4. 1b14.205c: LastWriteTime: 2018-02-10T06:15:34.902092600Z
  5. 1b14.205c: ChangeTime: 2018-02-14T16:43:49.400294500Z
  6. 1b14.205c: FileAttributes: 0x20
  7. 1b14.205c: Size: 0x1dd100
  8. 1b14.205c: NT Headers: 0xe0
  9. 1b14.205c: Timestamp: 0xeffc9126
  10. 1b14.205c: Machine: 0x8664 - amd64
  11. 1b14.205c: Timestamp: 0xeffc9126
  12. 1b14.205c: Image Version: 10.0
  13. 1b14.205c: SizeOfImage: 0x1e0000 (1966080)
  14. 1b14.205c: Resource Dir: 0x174000 LB 0x6a1d8
  15. 1b14.205c: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 1b14.205c: [Raw version resource data: 0x1740f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 1b14.205c: ProductName: Microsoft® Windows® Operating System
  18. 1b14.205c: ProductVersion: 10.0.16299.248
  19. 1b14.205c: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  20. 1b14.205c: FileDescription: NT Layer DLL
  21. 1b14.205c: \SystemRoot\System32\kernel32.dll:
  22. 1b14.205c: CreationTime: 2017-09-29T13:42:04.954227600Z
  23. 1b14.205c: LastWriteTime: 2017-09-29T13:42:04.954227600Z
  24. 1b14.205c: ChangeTime: 2017-11-22T17:43:40.644674600Z
  25. 1b14.205c: FileAttributes: 0x20
  26. 1b14.205c: Size: 0xab868
  27. 1b14.205c: NT Headers: 0xe8
  28. 1b14.205c: Timestamp: 0xc2cf900
  29. 1b14.205c: Machine: 0x8664 - amd64
  30. 1b14.205c: Timestamp: 0xc2cf900
  31. 1b14.205c: Image Version: 10.0
  32. 1b14.205c: SizeOfImage: 0xae000 (712704)
  33. 1b14.205c: Resource Dir: 0xac000 LB 0x520
  34. 1b14.205c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 1b14.205c: [Raw version resource data: 0xac0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 1b14.205c: ProductName: Microsoft® Windows® Operating System
  37. 1b14.205c: ProductVersion: 10.0.16299.15
  38. 1b14.205c: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  39. 1b14.205c: FileDescription: Windows NT BASE API Client DLL
  40. 1b14.205c: \SystemRoot\System32\KernelBase.dll:
  41. 1b14.205c: CreationTime: 2018-02-14T09:39:57.108712100Z
  42. 1b14.205c: LastWriteTime: 2018-02-10T06:15:53.408982400Z
  43. 1b14.205c: ChangeTime: 2018-02-14T16:43:47.382316100Z
  44. 1b14.205c: FileAttributes: 0x20
  45. 1b14.205c: Size: 0x266000
  46. 1b14.205c: NT Headers: 0xf0
  47. 1b14.205c: Timestamp: 0x4414ec23
  48. 1b14.205c: Machine: 0x8664 - amd64
  49. 1b14.205c: Timestamp: 0x4414ec23
  50. 1b14.205c: Image Version: 10.0
  51. 1b14.205c: SizeOfImage: 0x266000 (2514944)
  52. 1b14.205c: Resource Dir: 0x245000 LB 0x548
  53. 1b14.205c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 1b14.205c: [Raw version resource data: 0x2450b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  55. 1b14.205c: ProductName: Microsoft® Windows® Operating System
  56. 1b14.205c: ProductVersion: 10.0.16299.248
  57. 1b14.205c: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  58. 1b14.205c: FileDescription: Windows NT BASE API Client DLL
  59. 1b14.205c: \SystemRoot\System32\apisetschema.dll:
  60. 1b14.205c: CreationTime: 2017-09-29T13:42:07.095026600Z
  61. 1b14.205c: LastWriteTime: 2017-09-29T13:42:07.095026600Z
  62. 1b14.205c: ChangeTime: 2018-02-14T09:42:06.650663100Z
  63. 1b14.205c: FileAttributes: 0x20
  64. 1b14.205c: Size: 0x1b398
  65. 1b14.205c: NT Headers: 0xc8
  66. 1b14.205c: Timestamp: 0xf30abf31
  67. 1b14.205c: Machine: 0x8664 - amd64
  68. 1b14.205c: Timestamp: 0xf30abf31
  69. 1b14.205c: Image Version: 10.0
  70. 1b14.205c: SizeOfImage: 0x1c000 (114688)
  71. 1b14.205c: Resource Dir: 0x1b000 LB 0x408
  72. 1b14.205c: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 1b14.205c: [Raw version resource data: 0x1b060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  74. 1b14.205c: ProductName: Microsoft® Windows® Operating System
  75. 1b14.205c: ProductVersion: 10.0.16299.15
  76. 1b14.205c: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  77. 1b14.205c: FileDescription: ApiSet Schema DLL
  78. 1b14.205c: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 1b14.205c: supR3HardenedWinFindAdversaries: 0x0
  80. 1b14.205c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  81. 1b14.205c: Calling main()
  82. 1b14.205c: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  83. 1b14.205c: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  84. 1b14.205c: SUPR3HardenedMain: Respawn #1
  85. 1b14.205c: System32: \Device\HarddiskVolume3\Windows\System32
  86. 1b14.205c: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  87. 1b14.205c: KnownDllPath: C:\WINDOWS\System32
  88. 1b14.205c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  89. 1b14.205c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  90. 1b14.205c: supR3HardNtEnableThreadCreation:
  91. 1b14.205c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff955b291e0 pvNtTerminateThread=00007ff955b508d0
  92. 1b14.205c: supR3HardenedWinDoReSpawn(1): New child 1cb8.1fc8 [kernel32].
  93. 1b14.205c: supR3HardNtChildGatherData: PebBaseAddress=00000000009fe000 cbPeb=0x388
  94. 1b14.205c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff955ab0000 uNtDllChildAddr=00007ff955ab0000
  95. 1b14.205c: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff955b291e0
  96. 1b14.205c: supR3HardenedWinSetupChildInit: Start child.
  97. 1b14.205c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  98. 1b14.205c: supR3HardNtChildPurify: Startup delay kludge #1/0: 262 ms, 27 sleeps
  99. 1b14.205c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  100. 1b14.205c: *0000000000000000-00000000006cffff 0x0001/0x0000 0x0000000
  101. 1b14.205c: *00000000006d0000-00000000006effff 0x0004/0x0004 0x0020000
  102. 1b14.205c: *00000000006f0000-0000000000708fff 0x0002/0x0002 0x0040000
  103. 1b14.205c: 0000000000709000-000000000070ffff 0x0001/0x0000 0x0000000
  104. 1b14.205c: *0000000000710000-0000000000713fff 0x0002/0x0002 0x0040000
  105. 1b14.205c: 0000000000714000-000000000071ffff 0x0001/0x0000 0x0000000
  106. 1b14.205c: *0000000000720000-0000000000720fff 0x0004/0x0004 0x0020000
  107. 1b14.205c: 0000000000721000-00000000007fffff 0x0001/0x0000 0x0000000
  108. 1b14.205c: *0000000000800000-0000000000801fff 0x0004/0x0004 0x0020000
  109. 1b14.205c: 0000000000802000-00000000009fdfff 0x0000/0x0004 0x0020000
  110. 1b14.205c: 00000000009fe000-00000000009fefff 0x0004/0x0004 0x0020000
  111. 1b14.205c: 00000000009ff000-00000000009fffff 0x0000/0x0004 0x0020000
  112. 1b14.205c: *0000000000a00000-0000000000afafff 0x0000/0x0004 0x0020000
  113. 1b14.205c: 0000000000afb000-0000000000afdfff 0x0104/0x0004 0x0020000
  114. 1b14.205c: 0000000000afe000-0000000000afffff 0x0004/0x0004 0x0020000
  115. 1b14.205c: 0000000000b00000-000000007ffdffff 0x0001/0x0000 0x0000000
  116. 1b14.205c: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  117. 1b14.205c: *000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  118. 1b14.205c: 000000007fff0000-00007ff77418ffff 0x0001/0x0000 0x0000000
  119. 1b14.205c: *00007ff774190000-00007ff7741b2fff 0x0002/0x0002 0x0040000
  120. 1b14.205c: 00007ff7741b3000-00007ff7744fffff 0x0001/0x0000 0x0000000
  121. 1b14.205c: *00007ff774500000-00007ff774500fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  122. 1b14.205c: 00007ff774501000-00007ff774571fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  123. 1b14.205c: 00007ff774572000-00007ff774572fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  124. 1b14.205c: 00007ff774573000-00007ff7745b8fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  125. 1b14.205c: 00007ff7745b9000-00007ff7745b9fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  126. 1b14.205c: 00007ff7745ba000-00007ff7745bafff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  127. 1b14.205c: 00007ff7745bb000-00007ff7745bffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  128. 1b14.205c: 00007ff7745c0000-00007ff7745c0fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  129. 1b14.205c: 00007ff7745c1000-00007ff7745c1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  130. 1b14.205c: 00007ff7745c2000-00007ff7745c5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  131. 1b14.205c: 00007ff7745c6000-00007ff77460dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  132. 1b14.205c: 00007ff77460e000-00007ff955aaffff 0x0001/0x0000 0x0000000
  133. 1b14.205c: *00007ff955ab0000-00007ff955ab0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  134. 1b14.205c: 00007ff955ab1000-00007ff955bc2fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  135. 1b14.205c: 00007ff955bc3000-00007ff955c08fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  136. 1b14.205c: 00007ff955c09000-00007ff955c10fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  137. 1b14.205c: 00007ff955c11000-00007ff955c1efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  138. 1b14.205c: 00007ff955c1f000-00007ff955c1ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  139. 1b14.205c: 00007ff955c20000-00007ff955c22fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  140. 1b14.205c: 00007ff955c23000-00007ff955c8ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  141. 1b14.205c: 00007ff955c90000-00007ffffffdffff 0x0001/0x0000 0x0000000
  142. 1b14.205c: *00007ffffffe0000-00007ffffffeffff 0x0001/0x0002 0x0020000
  143. 1b14.205c: VirtualBox.exe: timestamp 0x5a5cc1cb (rc=VINF_SUCCESS)
  144. 1b14.205c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  145. 1b14.205c: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  146. 1b14.205c: supR3HardNtChildPurify: Done after 294 ms and 0 fixes (loop #0).
  147. 1cb8.1fc8: Log file opened: 5.2.6r120293 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa03fab00
  148. 1cb8.1fc8: supR3HardenedVmProcessInit: uNtDllAddr=00007ff955ab0000 g_uNtVerCombined=0xa03fab00
  149. 1cb8.1fc8: ntdll.dll: timestamp 0xeffc9126 (rc=VINF_SUCCESS)
  150. 1cb8.1fc8: New simple heap: #1 0000000000c00000 LB 0x400000 (for 1966080 allocation)
  151. 1b14.205c: supR3HardNtEnableThreadCreation:
  152. 1cb8.1fc8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  153. 1cb8.1fc8: System32: \Device\HarddiskVolume3\Windows\System32
  154. 1cb8.1fc8: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  155. 1cb8.1fc8: KnownDllPath: C:\WINDOWS\System32
  156. 1cb8.1fc8: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  157. 1cb8.1fc8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  158. 1cb8.1fc8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  159. 1cb8.1fc8: Registered Dll notification callback with NTDLL.
  160. 1cb8.1fc8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  161. 1cb8.1fc8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  162. 1cb8.1fc8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  163. 1cb8.1fc8: supR3HardenedDllNotificationCallback: load 00007ff952250000 LB 0x00266000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  164. 1cb8.1fc8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  165. 1cb8.1fc8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  166. 1cb8.1fc8: supR3HardenedDllNotificationCallback: load 00007ff955440000 LB 0x000ae000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  167. 1cb8.1fc8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  168. 1cb8.1fc8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955440000 'C:\WINDOWS\System32\KERNEL32.DLL'
  169. 1cb8.1fc8: supR3HardenedDllNotificationCallback: load 00007ff774500000 LB 0x0010e000 C:\Program Files\Oracle\VirtualBox\VirtualBox.exe [fFlags=0x0]
  170. 1cb8.1fc8: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  171. 1cb8.1fc8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  172. 1cb8.1fc8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  173. 1cb8.1fc8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff955b291e0 pvNtTerminateThread=00007ff955b508d0
  174. 1b14.205c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 78 ms.
  175. 1cb8.1fc8: \SystemRoot\System32\ntdll.dll:
  176. 1cb8.1fc8: CreationTime: 2018-02-14T09:40:22.763350100Z
  177. 1cb8.1fc8: LastWriteTime: 2018-02-10T06:15:34.902092600Z
  178. 1cb8.1fc8: ChangeTime: 2018-02-14T16:43:49.400294500Z
  179. 1cb8.1fc8: FileAttributes: 0x20
  180. 1cb8.1fc8: Size: 0x1dd100
  181. 1cb8.1fc8: NT Headers: 0xe0
  182. 1cb8.1fc8: Timestamp: 0xeffc9126
  183. 1cb8.1fc8: Machine: 0x8664 - amd64
  184. 1cb8.1fc8: Timestamp: 0xeffc9126
  185. 1cb8.1fc8: Image Version: 10.0
  186. 1cb8.1fc8: SizeOfImage: 0x1e0000 (1966080)
  187. 1cb8.1fc8: Resource Dir: 0x174000 LB 0x6a1d8
  188. 1cb8.1fc8: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  189. 1cb8.1fc8: [Raw version resource data: 0x1740f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  190. 1cb8.1fc8: ProductName: Microsoft® Windows® Operating System
  191. 1cb8.1fc8: ProductVersion: 10.0.16299.248
  192. 1cb8.1fc8: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  193. 1cb8.1fc8: FileDescription: NT Layer DLL
  194. 1cb8.1fc8: \SystemRoot\System32\kernel32.dll:
  195. 1cb8.1fc8: CreationTime: 2017-09-29T13:42:04.954227600Z
  196. 1cb8.1fc8: LastWriteTime: 2017-09-29T13:42:04.954227600Z
  197. 1cb8.1fc8: ChangeTime: 2017-11-22T17:43:40.644674600Z
  198. 1cb8.1fc8: FileAttributes: 0x20
  199. 1cb8.1fc8: Size: 0xab868
  200. 1cb8.1fc8: NT Headers: 0xe8
  201. 1cb8.1fc8: Timestamp: 0xc2cf900
  202. 1cb8.1fc8: Machine: 0x8664 - amd64
  203. 1cb8.1fc8: Timestamp: 0xc2cf900
  204. 1cb8.1fc8: Image Version: 10.0
  205. 1cb8.1fc8: SizeOfImage: 0xae000 (712704)
  206. 1cb8.1fc8: Resource Dir: 0xac000 LB 0x520
  207. 1cb8.1fc8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  208. 1cb8.1fc8: [Raw version resource data: 0xac0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  209. 1cb8.1fc8: ProductName: Microsoft® Windows® Operating System
  210. 1cb8.1fc8: ProductVersion: 10.0.16299.15
  211. 1cb8.1fc8: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  212. 1cb8.1fc8: FileDescription: Windows NT BASE API Client DLL
  213. 1cb8.1fc8: \SystemRoot\System32\KernelBase.dll:
  214. 1cb8.1fc8: CreationTime: 2018-02-14T09:39:57.108712100Z
  215. 1cb8.1fc8: LastWriteTime: 2018-02-10T06:15:53.408982400Z
  216. 1cb8.1fc8: ChangeTime: 2018-02-14T16:43:47.382316100Z
  217. 1cb8.1fc8: FileAttributes: 0x20
  218. 1cb8.1fc8: Size: 0x266000
  219. 1cb8.1fc8: NT Headers: 0xf0
  220. 1cb8.1fc8: Timestamp: 0x4414ec23
  221. 1cb8.1fc8: Machine: 0x8664 - amd64
  222. 1cb8.1fc8: Timestamp: 0x4414ec23
  223. 1cb8.1fc8: Image Version: 10.0
  224. 1cb8.1fc8: SizeOfImage: 0x266000 (2514944)
  225. 1cb8.1fc8: Resource Dir: 0x245000 LB 0x548
  226. 1cb8.1fc8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  227. 1cb8.1fc8: [Raw version resource data: 0x2450b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  228. 1cb8.1fc8: ProductName: Microsoft® Windows® Operating System
  229. 1cb8.1fc8: ProductVersion: 10.0.16299.248
  230. 1cb8.1fc8: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  231. 1cb8.1fc8: FileDescription: Windows NT BASE API Client DLL
  232. 1cb8.1fc8: \SystemRoot\System32\apisetschema.dll:
  233. 1cb8.1fc8: CreationTime: 2017-09-29T13:42:07.095026600Z
  234. 1cb8.1fc8: LastWriteTime: 2017-09-29T13:42:07.095026600Z
  235. 1cb8.1fc8: ChangeTime: 2018-02-14T09:42:06.650663100Z
  236. 1cb8.1fc8: FileAttributes: 0x20
  237. 1cb8.1fc8: Size: 0x1b398
  238. 1cb8.1fc8: NT Headers: 0xc8
  239. 1cb8.1fc8: Timestamp: 0xf30abf31
  240. 1cb8.1fc8: Machine: 0x8664 - amd64
  241. 1cb8.1fc8: Timestamp: 0xf30abf31
  242. 1cb8.1fc8: Image Version: 10.0
  243. 1cb8.1fc8: SizeOfImage: 0x1c000 (114688)
  244. 1cb8.1fc8: Resource Dir: 0x1b000 LB 0x408
  245. 1cb8.1fc8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  246. 1cb8.1fc8: [Raw version resource data: 0x1b060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  247. 1cb8.1fc8: ProductName: Microsoft® Windows® Operating System
  248. 1cb8.1fc8: ProductVersion: 10.0.16299.15
  249. 1cb8.1fc8: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  250. 1cb8.1fc8: FileDescription: ApiSet Schema DLL
  251. 1cb8.1fc8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  252. 1cb8.1fc8: supR3HardenedWinFindAdversaries: 0x0
  253. 1cb8.1fc8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  254. 1cb8.1fc8: Calling main()
  255. 1cb8.1fc8: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  256. 1cb8.1fc8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  257. 1cb8.1fc8: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  258. 1cb8.1fc8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  259. 1cb8.1fc8: SUPR3HardenedMain: Respawn #2
  260. 1cb8.1fc8: supR3HardNtEnableThreadCreation:
  261. 1cb8.1fc8: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  262. 1cb8.1fc8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntdll.dll)
  263. 1cb8.1fc8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  264. 1cb8.1fc8: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  265. 1cb8.1fc8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955ab0000 'C:\WINDOWS\System32\ntdll.dll'
  266. 1cb8.1fc8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff955b291e0 pvNtTerminateThread=00007ff955b508d0
  267. 1cb8.1fc8: supR3HardenedWinDoReSpawn(2): New child 504.6e0 [kernel32].
  268. 1cb8.1fc8: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
  269. 1cb8.1fc8: supR3HardNtChildGatherData: PebBaseAddress=0000000000847000 cbPeb=0x388
  270. 1cb8.1fc8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff955ab0000 uNtDllChildAddr=00007ff955ab0000
  271. 1cb8.1fc8: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff955b291e0
  272. 1cb8.1fc8: supR3HardenedWinSetupChildInit: Start child.
  273. 1cb8.1fc8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  274. 1cb8.1fc8: supR3HardNtChildPurify: Startup delay kludge #1/0: 260 ms, 26 sleeps
  275. 1cb8.1fc8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  276. 1cb8.1fc8: *0000000000000000-00000000006bffff 0x0001/0x0000 0x0000000
  277. 1cb8.1fc8: *00000000006c0000-00000000006dffff 0x0004/0x0004 0x0020000
  278. 1cb8.1fc8: *00000000006e0000-00000000006f8fff 0x0002/0x0002 0x0040000
  279. 1cb8.1fc8: 00000000006f9000-00000000006fffff 0x0001/0x0000 0x0000000
  280. 1cb8.1fc8: *0000000000700000-00000000007fafff 0x0000/0x0004 0x0020000
  281. 1cb8.1fc8: 00000000007fb000-00000000007fdfff 0x0104/0x0004 0x0020000
  282. 1cb8.1fc8: 00000000007fe000-00000000007fffff 0x0004/0x0004 0x0020000
  283. 1cb8.1fc8: *0000000000800000-0000000000846fff 0x0000/0x0004 0x0020000
  284. 1cb8.1fc8: 0000000000847000-0000000000849fff 0x0004/0x0004 0x0020000
  285. 1cb8.1fc8: 000000000084a000-00000000009fffff 0x0000/0x0004 0x0020000
  286. 1cb8.1fc8: *0000000000a00000-0000000000a03fff 0x0002/0x0002 0x0040000
  287. 1cb8.1fc8: 0000000000a04000-0000000000a0ffff 0x0001/0x0000 0x0000000
  288. 1cb8.1fc8: *0000000000a10000-0000000000a10fff 0x0004/0x0004 0x0020000
  289. 1cb8.1fc8: 0000000000a11000-000000007ffdffff 0x0001/0x0000 0x0000000
  290. 1cb8.1fc8: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  291. 1cb8.1fc8: *000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  292. 1cb8.1fc8: 000000007fff0000-00007ff7736affff 0x0001/0x0000 0x0000000
  293. 1cb8.1fc8: *00007ff7736b0000-00007ff7736d2fff 0x0002/0x0002 0x0040000
  294. 1cb8.1fc8: 00007ff7736d3000-00007ff7744fffff 0x0001/0x0000 0x0000000
  295. 1cb8.1fc8: *00007ff774500000-00007ff774500fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  296. 1cb8.1fc8: 00007ff774501000-00007ff774571fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  297. 1cb8.1fc8: 00007ff774572000-00007ff774572fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  298. 1cb8.1fc8: 00007ff774573000-00007ff7745b8fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  299. 1cb8.1fc8: 00007ff7745b9000-00007ff7745b9fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  300. 1cb8.1fc8: 00007ff7745ba000-00007ff7745bafff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  301. 1cb8.1fc8: 00007ff7745bb000-00007ff7745bffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  302. 1cb8.1fc8: 00007ff7745c0000-00007ff7745c0fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  303. 1cb8.1fc8: 00007ff7745c1000-00007ff7745c1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  304. 1cb8.1fc8: 00007ff7745c2000-00007ff7745c5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  305. 1cb8.1fc8: 00007ff7745c6000-00007ff77460dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  306. 1cb8.1fc8: 00007ff77460e000-00007ff955aaffff 0x0001/0x0000 0x0000000
  307. 1cb8.1fc8: *00007ff955ab0000-00007ff955ab0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  308. 1cb8.1fc8: 00007ff955ab1000-00007ff955bc2fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  309. 1cb8.1fc8: 00007ff955bc3000-00007ff955c08fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  310. 1cb8.1fc8: 00007ff955c09000-00007ff955c10fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  311. 1cb8.1fc8: 00007ff955c11000-00007ff955c1efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  312. 1cb8.1fc8: 00007ff955c1f000-00007ff955c1ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  313. 1cb8.1fc8: 00007ff955c20000-00007ff955c22fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  314. 1cb8.1fc8: 00007ff955c23000-00007ff955c8ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  315. 1cb8.1fc8: 00007ff955c90000-00007ffffffdffff 0x0001/0x0000 0x0000000
  316. 1cb8.1fc8: *00007ffffffe0000-00007ffffffeffff 0x0001/0x0002 0x0020000
  317. 1cb8.1fc8: VirtualBox.exe: timestamp 0x5a5cc1cb (rc=VINF_SUCCESS)
  318. 1cb8.1fc8: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  319. 1cb8.1fc8: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  320. 1cb8.1fc8: supR3HardNtChildPurify: Done after 293 ms and 0 fixes (loop #0).
  321. 504.6e0: Log file opened: 5.2.6r120293 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa03fab00
  322. 504.6e0: supR3HardenedVmProcessInit: uNtDllAddr=00007ff955ab0000 g_uNtVerCombined=0xa03fab00
  323. 504.6e0: ntdll.dll: timestamp 0xeffc9126 (rc=VINF_SUCCESS)
  324. 504.6e0: New simple heap: #1 0000000000b20000 LB 0x400000 (for 1966080 allocation)
  325. 1cb8.1fc8: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000c00000 LB 0x400000)
  326. 1cb8.1fc8: supR3HardNtEnableThreadCreation:
  327. 504.6e0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  328. 504.6e0: System32: \Device\HarddiskVolume3\Windows\System32
  329. 504.6e0: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  330. 504.6e0: KnownDllPath: C:\WINDOWS\System32
  331. 504.6e0: supR3HardenedVmProcessInit: Opening vboxdrv...
  332. 504.6e0: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  333. 504.6e0: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  334. 504.6e0: Registered Dll notification callback with NTDLL.
  335. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  336. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  337. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  338. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952250000 LB 0x00266000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  339. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  340. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  341. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955440000 LB 0x000ae000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  342. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  343. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955440000 'C:\WINDOWS\System32\KERNEL32.DLL'
  344. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff774500000 LB 0x0010e000 C:\Program Files\Oracle\VirtualBox\VirtualBox.exe [fFlags=0x0]
  345. 504.6e0: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  346. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  347. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe
  348. 504.6e0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff955b291e0 pvNtTerminateThread=00007ff955b508d0
  349. 1cb8.1fc8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 85 ms.
  350. 504.6e0: \SystemRoot\System32\ntdll.dll:
  351. 504.6e0: CreationTime: 2018-02-14T09:40:22.763350100Z
  352. 504.6e0: LastWriteTime: 2018-02-10T06:15:34.902092600Z
  353. 504.6e0: ChangeTime: 2018-02-14T16:43:49.400294500Z
  354. 504.6e0: FileAttributes: 0x20
  355. 504.6e0: Size: 0x1dd100
  356. 504.6e0: NT Headers: 0xe0
  357. 504.6e0: Timestamp: 0xeffc9126
  358. 504.6e0: Machine: 0x8664 - amd64
  359. 504.6e0: Timestamp: 0xeffc9126
  360. 504.6e0: Image Version: 10.0
  361. 504.6e0: SizeOfImage: 0x1e0000 (1966080)
  362. 504.6e0: Resource Dir: 0x174000 LB 0x6a1d8
  363. 504.6e0: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  364. 504.6e0: [Raw version resource data: 0x1740f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  365. 504.6e0: ProductName: Microsoft® Windows® Operating System
  366. 504.6e0: ProductVersion: 10.0.16299.248
  367. 504.6e0: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  368. 504.6e0: FileDescription: NT Layer DLL
  369. 504.6e0: \SystemRoot\System32\kernel32.dll:
  370. 504.6e0: CreationTime: 2017-09-29T13:42:04.954227600Z
  371. 504.6e0: LastWriteTime: 2017-09-29T13:42:04.954227600Z
  372. 504.6e0: ChangeTime: 2017-11-22T17:43:40.644674600Z
  373. 504.6e0: FileAttributes: 0x20
  374. 504.6e0: Size: 0xab868
  375. 504.6e0: NT Headers: 0xe8
  376. 504.6e0: Timestamp: 0xc2cf900
  377. 504.6e0: Machine: 0x8664 - amd64
  378. 504.6e0: Timestamp: 0xc2cf900
  379. 504.6e0: Image Version: 10.0
  380. 504.6e0: SizeOfImage: 0xae000 (712704)
  381. 504.6e0: Resource Dir: 0xac000 LB 0x520
  382. 504.6e0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  383. 504.6e0: [Raw version resource data: 0xac0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  384. 504.6e0: ProductName: Microsoft® Windows® Operating System
  385. 504.6e0: ProductVersion: 10.0.16299.15
  386. 504.6e0: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  387. 504.6e0: FileDescription: Windows NT BASE API Client DLL
  388. 504.6e0: \SystemRoot\System32\KernelBase.dll:
  389. 504.6e0: CreationTime: 2018-02-14T09:39:57.108712100Z
  390. 504.6e0: LastWriteTime: 2018-02-10T06:15:53.408982400Z
  391. 504.6e0: ChangeTime: 2018-02-14T16:43:47.382316100Z
  392. 504.6e0: FileAttributes: 0x20
  393. 504.6e0: Size: 0x266000
  394. 504.6e0: NT Headers: 0xf0
  395. 504.6e0: Timestamp: 0x4414ec23
  396. 504.6e0: Machine: 0x8664 - amd64
  397. 504.6e0: Timestamp: 0x4414ec23
  398. 504.6e0: Image Version: 10.0
  399. 504.6e0: SizeOfImage: 0x266000 (2514944)
  400. 504.6e0: Resource Dir: 0x245000 LB 0x548
  401. 504.6e0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  402. 504.6e0: [Raw version resource data: 0x2450b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  403. 504.6e0: ProductName: Microsoft® Windows® Operating System
  404. 504.6e0: ProductVersion: 10.0.16299.248
  405. 504.6e0: FileVersion: 10.0.16299.248 (WinBuild.160101.0800)
  406. 504.6e0: FileDescription: Windows NT BASE API Client DLL
  407. 504.6e0: \SystemRoot\System32\apisetschema.dll:
  408. 504.6e0: CreationTime: 2017-09-29T13:42:07.095026600Z
  409. 504.6e0: LastWriteTime: 2017-09-29T13:42:07.095026600Z
  410. 504.6e0: ChangeTime: 2018-02-14T09:42:06.650663100Z
  411. 504.6e0: FileAttributes: 0x20
  412. 504.6e0: Size: 0x1b398
  413. 504.6e0: NT Headers: 0xc8
  414. 504.6e0: Timestamp: 0xf30abf31
  415. 504.6e0: Machine: 0x8664 - amd64
  416. 504.6e0: Timestamp: 0xf30abf31
  417. 504.6e0: Image Version: 10.0
  418. 504.6e0: SizeOfImage: 0x1c000 (114688)
  419. 504.6e0: Resource Dir: 0x1b000 LB 0x408
  420. 504.6e0: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  421. 504.6e0: [Raw version resource data: 0x1b060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  422. 504.6e0: ProductName: Microsoft® Windows® Operating System
  423. 504.6e0: ProductVersion: 10.0.16299.15
  424. 504.6e0: FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
  425. 504.6e0: FileDescription: ApiSet Schema DLL
  426. 504.6e0: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  427. 504.6e0: supR3HardenedWinFindAdversaries: 0x0
  428. 504.6e0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  429. 504.6e0: Calling main()
  430. 504.6e0: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  431. 504.6e0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  432. 504.6e0: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  433. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  434. 504.6e0: SUPR3HardenedMain: Final process, opening VBoxDrv...
  435. 504.6e0: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000b20000 LB 0x400000)
  436. 504.6e0: supR3HardNtEnableThreadCreation:
  437. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  438. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  439. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  440. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  441. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff950110000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  442. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  443. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  444. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  445. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff950110000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  446. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  447. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  448. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff950110000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  449. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff950110000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  450. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  451. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msasn1.dll'.
  452. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
  453. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  454. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wintrust.dll)
  455. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wintrust.dll
  456. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  457. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  458. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
  459. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  460. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  461. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  462. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'msasn1.dll'.
  463. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\crypt32.dll)
  464. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  465. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  466. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  467. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msasn1.dll)
  468. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msasn1.dll
  469. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  470. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  471. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcrt.dll)
  472. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  473. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  474. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  475. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  476. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  477. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954fc0000 LB 0x0009d000 C:\WINDOWS\System32\msvcrt.dll [fFlags=0x0]
  478. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  479. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951e70000 LB 0x00012000 C:\WINDOWS\System32\MSASN1.dll [fFlags=0x0]
  480. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  481. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951eb0000 LB 0x000f6000 C:\WINDOWS\System32\ucrtbase.dll [fFlags=0x0]
  482. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll)
  483. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ucrtbase.dll
  484. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952c10000 LB 0x001ce000 C:\WINDOWS\System32\CRYPT32.dll [fFlags=0x0]
  485. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  486. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954de0000 LB 0x0011f000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  487. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  488. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954f60000 LB 0x0005b000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  489. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
  490. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
  491. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
  492. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9548d0000 LB 0x000a1000 C:\WINDOWS\System32\advapi32.dll [fFlags=0x0]
  493. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  494. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
  495. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  496. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\advapi32.dll)
  497. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  498. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952050000 LB 0x00058000 C:\WINDOWS\System32\Wintrust.dll [fFlags=0x0]
  499. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  500. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  501. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  502. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-synch-l1-2-0'
  503. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  504. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  505. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-fibers-l1-1-1'
  506. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  507. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  508. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-fibers-l1-1-1'
  509. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  510. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  511. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-synch-l1-2-0'
  512. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  513. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  514. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-localization-l1-2-1'
  515. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\WINDOWS\system32\Wintrust.dll'
  516. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcrypt.dll)
  517. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  518. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  519. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  520. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  521. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
  522. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume3\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
  523. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  524. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  525. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  526. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  527. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  528. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  529. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  530. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  531. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  532. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951960000 LB 0x00025000 C:\WINDOWS\system32\bcrypt.dll [fFlags=0x0]
  533. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  534. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff951960000 'C:\WINDOWS\system32\bcrypt.dll'
  535. 504.6e0: bcrypt.dll loaded at 00007ff951960000, BCryptOpenAlgorithmProvider at 00007ff951962590, preloading providers:
  536. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll)
  537. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  538. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  539. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952de0000 LB 0x00072000 C:\WINDOWS\System32\bcryptprimitives.dll [fFlags=0x0]
  540. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  541. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952de0000 'C:\WINDOWS\system32\bcryptprimitives.dll'
  542. 504.6e0: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=0000000003005410)
  543. 504.6e0: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=000000000300f1a0)
  544. 504.6e0: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=000000000300f470)
  545. 504.6e0: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=000000000300f740)
  546. 504.6e0: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=0000000003010220)
  547. 504.6e0: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000030104f0)
  548. 504.6e0: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000030107c0)
  549. 504.6e0: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=0000000003010ea0)
  550. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  551. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  552. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  553. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  554. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  555. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  556. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  557. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  558. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  559. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  560. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  561. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  562. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  563. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  564. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  565. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  566. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  567. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  568. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  569. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  570. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  571. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptsp.dll)
  572. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptsp.dll
  573. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951860000 LB 0x00017000 C:\WINDOWS\SYSTEM32\CRYPTSP.dll [fFlags=0x0]
  574. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  575. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
  576. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rsaenh.dll)
  577. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  578. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  579. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  580. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  581. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  582. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  583. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9512a0000 LB 0x00033000 C:\WINDOWS\system32\rsaenh.dll [fFlags=0x0]
  584. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  585. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  586. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
  587. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptbase.dll)
  588. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptbase.dll
  589. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951850000 LB 0x0000b000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
  590. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  591. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  592. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  593. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  594. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  595. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  596. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955440000 'C:\WINDOWS\System32\kernel32.dll'
  597. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  598. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  599. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  600. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  601. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\CRYPT32.dll'
  602. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955210000 LB 0x0001d000 C:\WINDOWS\System32\imagehlp.dll [fFlags=0x0]
  603. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imagehlp.dll)
  604. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imagehlp.dll
  605. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  606. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  607. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  608. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  609. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  610. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gpapi.dll)
  611. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gpapi.dll
  612. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff950bf0000 LB 0x00022000 C:\WINDOWS\SYSTEM32\gpapi.dll [fFlags=0x0]
  613. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  614. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951e00000 LB 0x0001b000 C:\WINDOWS\System32\profapi.dll [fFlags=0x0]
  615. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\profapi.dll)
  616. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\profapi.dll
  617. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  618. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
  619. 504.6e0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\cryptnet.dll)
  620. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptnet.dll
  621. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  622. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  623. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  624. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  625. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  626. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  627. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  628. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  629. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  630. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  631. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  632. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  633. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  634. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  635. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff938090000 LB 0x0002f000 C:\WINDOWS\System32\cryptnet.dll [fFlags=0x0]
  636. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  637. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  638. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  639. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  640. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  641. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  642. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  643. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  644. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  645. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  646. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  647. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  648. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  649. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  650. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  651. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  652. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  653. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  654. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  655. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  656. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  657. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  658. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  659. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  660. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  661. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  662. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  663. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  664. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  665. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\WINDOWS\System32\cryptnet.dll'
  666. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  667. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff938090000 'C:\Windows\System32\cryptnet.dll'
  668. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  669. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  670. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  671. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  672. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  673. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  674. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  675. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000030894d0
  676. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  677. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6B794ACDFBB707D3DF3C6A6F6EE1A5DF718084B1
  678. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  679. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  680. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954de0000 'C:\WINDOWS\System32\rpcrt4.dll'
  681. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  682. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  683. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  684. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  685. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  686. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  687. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  688. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  689. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  690. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  691. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  692. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  693. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  694. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  695. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  696. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  697. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  698. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  699. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  700. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  701. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  702. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_999_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat'; file='\SystemRoot\System32\ntdll.dll'
  703. 504.6e0: g_pfnWinVerifyTrust=00007ff952056bc0
  704. 504.6e0: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  705. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  706. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  707. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  708. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  709. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  710. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  711. 504.6e0: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\crypt32.dll'
  712. 504.6e0: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  713. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  714. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  715. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  716. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  717. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  718. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  719. 504.6e0: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\wintrust.dll'
  720. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000388 pwszName=\Device\HarddiskVolume3\Windows\System32\cryptnet.dll
  721. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  722. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  723. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5A0BC1B38B9F5EE15493A1BB6ABB29D2FFBB4119
  724. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  725. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  726. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  727. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  728. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0015~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
  729. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  730. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
  731. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  732. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  733. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  734. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\profapi.dll'
  735. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  736. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  737. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  738. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gpapi.dll'
  739. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  740. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  741. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  742. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imagehlp.dll'
  743. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  744. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  745. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  746. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptbase.dll'
  747. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  748. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  749. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  750. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rsaenh.dll'
  751. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  752. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  753. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptsp.dll'
  754. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  755. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  756. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  757. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  758. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll'
  759. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  760. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  761. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  762. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  763. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll'
  764. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  765. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  766. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\advapi32.dll'
  767. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  768. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  769. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\sechost.dll'
  770. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  771. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  772. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll'
  773. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  774. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  775. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll'
  776. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  777. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  778. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msasn1.dll'
  779. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  780. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  781. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll'
  782. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  783. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  784. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  785. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.exe'
  786. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  787. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  788. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\KernelBase.dll'
  789. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  790. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  791. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel32.dll'
  792. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\system32\crypt32.dll'
  793. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  794. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  795. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xe41028e0bfbdb100 C=US, ST=California, L=Irvine, O=Blizzard Entertainment, OU=Battle.net, CN=Blizzard Battle.net Local Cert
  796. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  797. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
  798. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  799. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  800. 504.6e0: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=BZ, ST=Belize, L=Belize City, O=DT Soft Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=DT Soft Ltd
  801. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  802. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  803. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  804. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x64db4864a542b500 C=HU, L=Budapest, O=NISZ Nemzeti Infokommunikációs Szolgáltató Zrt., CN=Főtanúsítványkiadó - Kormányzati Hitelesítés Szolgáltató
  805. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
  806. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  807. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  808. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
  809. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  810. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xe248b7eeee4af00 C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2
  811. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  812. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  813. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  814. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
  815. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x1591b8ac8dcabd00 C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign
  816. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  817. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  818. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  819. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  820. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  821. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  822. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  823. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x2fba703484f19900 C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009
  824. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  825. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xdaad63f38ff8e900 C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, [email protected]
  826. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
  827. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  828. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  829. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, [email protected]
  830. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  831. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  832. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
  833. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xf8dae202a2dfca00 C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
  834. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
  835. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  836. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  837. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  838. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  839. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  840. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
  841. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  842. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xe66b56ffc86e50a4 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA, [email protected]
  843. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  844. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x6d4bbe735e24c400 C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány
  845. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  846. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  847. 504.6e0: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  848. 504.6e0: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=54
  849. 504.6e0: SUPR3HardenedMain: Load Runtime...
  850. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  851. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  852. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  853. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  854. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  855. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  856. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  857. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  858. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  859. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  860. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  861. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  862. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  863. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  864. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  865. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ws2_32.dll) WinVerifyTrust
  866. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  867. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  868. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  869. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  870. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  871. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  872. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  873. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  874. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  875. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  876. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  877. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  878. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  879. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  880. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  881. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll)
  882. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  883. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  884. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  885. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  886. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  887. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  888. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  889. 504.6e0: supR3HardenedDllNotificationCallback: load 0000000053ba0000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  890. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  891. 504.6e0: supR3HardenedDllNotificationCallback: load 0000000053b00000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  892. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  893. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9559e0000 LB 0x0006c000 C:\WINDOWS\System32\WS2_32.dll [fFlags=0x0]
  894. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  895. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff926690000 LB 0x00590000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  896. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  897. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  898. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  899. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  900. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  901. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  902. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  903. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  904. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  905. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  906. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  907. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  908. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  909. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  910. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  911. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  912. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  913. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  914. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  915. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  916. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  917. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  918. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  919. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  920. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  921. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  922. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  923. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  924. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  925. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  926. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  927. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  928. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  929. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  930. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  931. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  932. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  933. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  934. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  935. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  936. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  937. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  938. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  939. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  940. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  941. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  942. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  943. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  944. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  945. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  946. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  947. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff926690000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  948. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\WINDOWS\system32\Wintrust.dll'
  949. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  950. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  951. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  952. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  953. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  954. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  955. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\system32\crypt32.dll'
  956. 504.6e0: SUPR3HardenedMain: Load TrustedMain...
  957. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  958. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  959. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  960. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  961. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  962. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  963. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
  964. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
  965. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
  966. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  967. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  968. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  969. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  970. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  971. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  972. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
  973. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll) WinVerifyTrust
  974. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  975. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  976. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  977. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  978. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  979. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'winmmbase.dll'.
  980. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  981. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmm.dll) WinVerifyTrust
  982. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmm.dll
  983. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  984. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  985. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  986. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  987. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  988. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
  989. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
  990. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
  991. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  992. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmmbase.dll)
  993. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmmbase.dll
  994. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  995. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  996. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  997. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  998. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  999. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1000. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1001. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1002. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
  1003. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
  1004. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleaut32.dll) WinVerifyTrust
  1005. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1006. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1007. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1008. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1009. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1010. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1011. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1012. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1013. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  1014. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1015. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'bcryptprimitives.dll'.
  1016. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\combase.dll)
  1017. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\combase.dll
  1018. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1019. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1020. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  1021. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll)
  1022. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  1023. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  1024. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  1025. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  1026. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1027. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1028. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1029. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1030. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
  1031. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'gdi32.dll'.
  1032. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'user32.dll'.
  1033. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'combase.dll'.
  1034. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ole32.dll) WinVerifyTrust
  1035. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1036. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1037. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1038. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1039. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1040. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [lacks WinVerifyTrust]
  1041. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1042. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1043. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  1044. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1045. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
  1046. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\user32.dll)
  1047. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\user32.dll
  1048. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1049. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1050. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  1051. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32.dll)
  1052. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1053. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1054. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1055. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1056. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1057. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1058. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1059. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1060. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  1061. 504.6e0: '\Device\HarddiskVolume3\Windows\System32\win32u.dll' has no imports
  1062. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\win32u.dll)
  1063. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\win32u.dll
  1064. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1065. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1066. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1067. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #73 'user32.dll'.
  1068. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #75 'gdi32.dll'.
  1069. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shell32.dll) WinVerifyTrust
  1070. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1071. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1072. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1073. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1074. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1075. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1076. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
  1077. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1078. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1079. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1080. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1081. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1082. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1083. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1084. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1085. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1086. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1087. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1088. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\user32.dll'
  1089. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1090. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1091. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1092. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1093. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1094. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1095. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1096. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1097. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1098. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
  1099. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
  1100. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1101. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1102. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [lacks WinVerifyTrust]
  1103. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1104. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1105. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'.
  1106. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1107. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1108. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1109. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1110. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1111. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1112. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1113. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1114. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll)
  1115. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1116. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1117. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1118. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'.
  1119. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1120. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1121. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1122. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1123. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1124. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1125. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1126. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll)
  1127. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1128. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1129. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1130. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  1131. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1132. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1133. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1134. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1135. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1136. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1137. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1138. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll)
  1139. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1140. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1141. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1142. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [lacks WinVerifyTrust]
  1143. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1144. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1145. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1146. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1147. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1148. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1149. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1150. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1151. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1152. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1153. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1154. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  1155. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1156. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1157. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1158. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1159. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1160. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1161. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1162. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1163. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [lacks WinVerifyTrust]
  1164. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1165. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1166. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1167. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1168. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1169. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1170. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1171. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1172. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1173. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1174. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1175. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1176. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1177. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1178. 504.6e0: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'.
  1179. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1180. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  1181. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1182. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1183. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'glu32.dll'.
  1184. 504.6e0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\opengl32.dll)
  1185. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1186. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1187. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1188. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1189. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1190. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1191. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [lacks WinVerifyTrust]
  1192. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1193. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1194. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1195. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  1196. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  1197. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  1198. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mpr.dll)
  1199. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mpr.dll
  1200. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1201. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1202. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1203. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1204. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1205. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1206. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1207. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1208. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1209. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1210. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1211. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1212. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1213. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1214. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1215. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  1216. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  1217. 504.6e0: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  1218. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1219. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1220. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'opengl32.dll'.
  1221. 504.6e0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\glu32.dll)
  1222. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\glu32.dll
  1223. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1224. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1225. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1226. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1227. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1228. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1229. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1230. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1231. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1232. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1233. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1234. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1235. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1236. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1237. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
  1238. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1239. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1240. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1241. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1242. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1243. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1244. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1245. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1246. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
  1247. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1248. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1249. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1250. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
  1251. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
  1252. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll) WinVerifyTrust
  1253. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1254. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1255. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1256. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [redoing WinVerifyTrust]
  1257. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1258. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1259. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [lacks WinVerifyTrust]
  1260. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  1261. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume3\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  1262. 504.6e0: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\comdlg32.dll'.
  1263. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1264. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'user32.dll'.
  1265. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'shlwapi.dll'.
  1266. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
  1267. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'comctl32.dll'.
  1268. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'shell32.dll'.
  1269. 504.6e0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\comdlg32.dll)
  1270. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\comdlg32.dll
  1271. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  1272. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume3\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  1273. 504.6e0: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\winspool.drv'.
  1274. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1275. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'iphlpapi.dll'.
  1276. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'bcrypt.dll'.
  1277. 504.6e0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\winspool.drv)
  1278. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winspool.drv
  1279. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1280. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1281. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  1282. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1283. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1284. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  1285. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1286. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1287. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
  1288. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1289. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1290. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1291. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1292. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1293. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1294. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1295. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1296. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  1297. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  1298. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  1299. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL'.
  1300. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL)
  1301. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  1302. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1303. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1304. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1305. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1306. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1307. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  1308. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  1309. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\comctl32.dll'.
  1310. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  1311. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1312. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1313. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\comctl32.dll)
  1314. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\comctl32.dll
  1315. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1316. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1317. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1318. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1319. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1320. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
  1321. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1322. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'gdi32.dll'.
  1323. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'user32.dll'.
  1324. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shlwapi.dll)
  1325. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  1326. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1327. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1328. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1329. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1330. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1331. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1332. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1333. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1334. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1335. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1336. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1337. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1338. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1339. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1340. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1341. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1342. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1343. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1344. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1345. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1346. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'
  1347. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1348. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1349. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [redoing WinVerifyTrust]
  1350. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1351. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'
  1352. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1353. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1354. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
  1355. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1356. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'
  1357. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1358. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1359. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [redoing WinVerifyTrust]
  1360. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1361. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'
  1362. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1363. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1364. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1365. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1366. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1367. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1368. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1369. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [redoing WinVerifyTrust]
  1370. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004b4 pwszName=\Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1371. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  1372. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  1373. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F39C902102F30859FF82648A950427FCB81FB124
  1374. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1375. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1376. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00111~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
  1377. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1378. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
  1379. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  1380. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1381. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1382. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1383. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1384. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1385. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1386. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1387. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1388. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  1389. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  1390. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\winspool.drv [avoiding WinVerifyTrust]
  1391. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  1392. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1393. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1394. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll)
  1395. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll
  1396. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
  1397. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL [avoiding WinVerifyTrust]
  1398. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952f60000 LB 0x00020000 C:\WINDOWS\System32\win32u.dll [fFlags=0x0]
  1399. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
  1400. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951fb0000 LB 0x0009b000 C:\WINDOWS\System32\msvcp_win.dll [fFlags=0x0]
  1401. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
  1402. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9520b0000 LB 0x00193000 C:\WINDOWS\System32\gdi32full.dll [fFlags=0x0]
  1403. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  1404. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1405. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'user32.dll'.
  1406. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'win32u.dll'.
  1407. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32full.dll)
  1408. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32full.dll
  1409. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955a50000 LB 0x00028000 C:\WINDOWS\System32\GDI32.dll [fFlags=0x0]
  1410. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
  1411. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954bc0000 LB 0x0018f000 C:\WINDOWS\System32\USER32.dll [fFlags=0x0]
  1412. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff930900000 LB 0x0002c000 C:\WINDOWS\SYSTEM32\GLU32.dll [fFlags=0x0]
  1413. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  1414. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff930970000 LB 0x0011e000 C:\WINDOWS\SYSTEM32\OPENGL32.dll [fFlags=0x0]
  1415. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  1416. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952f10000 LB 0x0004a000 C:\WINDOWS\System32\cfgmgr32.dll [fFlags=0x0]
  1417. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll)
  1418. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
  1419. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9545c0000 LB 0x00308000 C:\WINDOWS\System32\combase.dll [fFlags=0x0]
  1420. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [avoiding WinVerifyTrust]
  1421. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955240000 LB 0x000a6000 C:\WINDOWS\System32\shcore.dll [fFlags=0x0]
  1422. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1423. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'rpcrt4.dll'.
  1424. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'combase.dll'.
  1425. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\SHCore.dll)
  1426. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  1427. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954d80000 LB 0x00051000 C:\WINDOWS\System32\shlwapi.dll [fFlags=0x0]
  1428. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll [avoiding WinVerifyTrust]
  1429. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951e90000 LB 0x00011000 C:\WINDOWS\System32\kernel.appcore.dll [fFlags=0x0]
  1430. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
  1431. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  1432. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll)
  1433. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll
  1434. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951e20000 LB 0x0004c000 C:\WINDOWS\System32\powrprof.dll [fFlags=0x0]
  1435. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  1436. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\powrprof.dll)
  1437. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\powrprof.dll
  1438. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9524c0000 LB 0x00747000 C:\WINDOWS\System32\windows.storage.dll [fFlags=0x0]
  1439. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1440. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  1441. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #55 'combase.dll'.
  1442. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #75 'profapi.dll'.
  1443. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\windows.storage.dll)
  1444. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\windows.storage.dll
  1445. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff952f80000 LB 0x01436000 C:\WINDOWS\System32\SHELL32.dll [fFlags=0x0]
  1446. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1447. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9552f0000 LB 0x00149000 C:\WINDOWS\System32\ole32.dll [fFlags=0x0]
  1448. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1449. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94cb00000 LB 0x0001b000 C:\WINDOWS\SYSTEM32\MPR.dll [fFlags=0x0]
  1450. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  1451. 504.6e0: supR3HardenedDllNotificationCallback: load 0000000053590000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  1452. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1453. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff91c9b0000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  1454. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1455. 504.6e0: supR3HardenedDllNotificationCallback: load 0000000053020000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  1456. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1457. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951420000 LB 0x00039000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
  1458. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL [avoiding WinVerifyTrust]
  1459. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff949d70000 LB 0x00086000 C:\WINDOWS\SYSTEM32\WINSPOOL.DRV [fFlags=0x0]
  1460. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\winspool.drv [avoiding WinVerifyTrust]
  1461. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff949fa0000 LB 0x000a6000 C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\COMCTL32.dll [fFlags=0x0]
  1462. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll [avoiding WinVerifyTrust]
  1463. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955080000 LB 0x0010a000 C:\WINDOWS\System32\COMDLG32.dll [fFlags=0x0]
  1464. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\comdlg32.dll [avoiding WinVerifyTrust]
  1465. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff945570000 LB 0x00051000 C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll [fFlags=0x0]
  1466. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1467. 504.6e0: supR3HardenedDllNotificationCallback: load 0000000052fc0000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  1468. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1469. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954af0000 LB 0x000c5000 C:\WINDOWS\System32\OLEAUT32.dll [fFlags=0x0]
  1470. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1471. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94e8a0000 LB 0x0002a000 C:\WINDOWS\SYSTEM32\WINMMBASE.dll [fFlags=0x0]
  1472. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
  1473. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94e9b0000 LB 0x00023000 C:\WINDOWS\SYSTEM32\WINMM.dll [fFlags=0x0]
  1474. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1475. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff91cfb0000 LB 0x00a33000 C:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  1476. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1477. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
  1478. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
  1479. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
  1480. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
  1481. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
  1482. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
  1483. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
  1484. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
  1485. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
  1486. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
  1487. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  1488. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  1489. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll'.
  1490. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll' [rescheduled]
  1491. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
  1492. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
  1493. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\comctl32.dll'.
  1494. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\comctl32.dll' [rescheduled]
  1495. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL'.
  1496. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL' [rescheduled]
  1497. 504.6e0: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\winspool.drv'.
  1498. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winspool.drv' [rescheduled]
  1499. 504.6e0: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\comdlg32.dll'.
  1500. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\comdlg32.dll' [rescheduled]
  1501. 504.6e0: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  1502. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  1503. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  1504. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  1505. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  1506. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  1507. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  1508. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  1509. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  1510. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  1511. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  1512. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  1513. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
  1514. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
  1515. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  1516. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1517. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1518. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll
  1519. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1520. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1521. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [redoing WinVerifyTrust]
  1522. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  1523. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\combase.dll
  1524. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1525. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1526. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1527. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1528. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1529. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1530. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1531. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1532. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1533. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1534. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1535. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1536. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [redoing WinVerifyTrust]
  1537. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  1538. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\combase.dll
  1539. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1540. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1541. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1542. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1543. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1544. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1545. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1546. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  1547. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
  1548. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1549. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1550. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1551. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1552. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1553. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  1554. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1555. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  1556. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  1557. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  1558. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  1559. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  1560. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1561. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1562. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1563. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1564. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1565. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  1566. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1567. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1568. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1569. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1570. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1571. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955440000 'C:\WINDOWS\System32\kernel32.dll'
  1572. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  1573. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1574. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-string-l1-1-0'
  1575. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  1576. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1577. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-datetime-l1-1-1'
  1578. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  1579. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1580. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-localization-obsolete-l1-2-0'
  1581. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  1582. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1583. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'win32u.dll'.
  1584. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imm32.dll)
  1585. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imm32.dll
  1586. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1587. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1588. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  1589. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  1590. 504.6e0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
  1591. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1592. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1593. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1594. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954d50000 LB 0x0002d000 C:\WINDOWS\System32\IMM32.DLL [fFlags=0x0]
  1595. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
  1596. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954d50000 'C:\WINDOWS\system32\IMM32.DLL'
  1597. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  1598. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
  1599. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [redoing WinVerifyTrust]
  1600. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  1601. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\imm32.dll
  1602. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1603. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954d50000 'C:\WINDOWS\System32\imm32.dll'
  1604. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1605. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1606. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9548d0000 'C:\WINDOWS\System32\ADVAPI32.DLL'
  1607. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff91cfb0000 'C:\Program Files\Oracle\VirtualBox\VirtualBox.dll'
  1608. 504.6e0: SUPR3HardenedMain: Calling TrustedMain (00007ff91cfb14f0)...
  1609. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1610. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1611. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  1612. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1613. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  1614. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  1615. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  1616. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  1617. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  1618. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  1619. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  1620. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  1621. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  1622. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  1623. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1624. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1625. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1626. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1627. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1628. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1629. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1630. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1631. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1632. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1633. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1634. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1635. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1636. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1637. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1638. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1639. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1640. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1641. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1642. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1643. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1644. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1645. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [redoing WinVerifyTrust]
  1646. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1647. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1648. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll'
  1649. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1650. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1651. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  1652. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1653. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1654. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1655. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1656. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1657. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  1658. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1659. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1660. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'
  1661. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1662. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  1663. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff93fe70000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  1664. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  1665. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93fe70000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  1666. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000684 pwszName=\Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  1667. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  1668. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  1669. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB199956403E78CE61C981F6BA97CA632BE55AC
  1670. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1671. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1672. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\uxtheme.dll'
  1673. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1674. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1675. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  1676. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
  1677. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\uxtheme.dll) WinVerifyTrust
  1678. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  1679. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1680. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1681. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1682. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1683. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1684. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1685. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1686. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  1687. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  1688. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9503f0000 LB 0x00095000 C:\WINDOWS\system32\uxtheme.dll [fFlags=0x0]
  1689. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  1690. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9503f0000 'C:\WINDOWS\system32\uxtheme.dll'
  1691. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954bc0000 'C:\WINDOWS\system32\user32.dll'
  1692. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1693. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1694. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952f80000 'C:\WINDOWS\system32\shell32.dll'
  1695. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll [redoing WinVerifyTrust]
  1696. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1697. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1698. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'
  1699. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1700. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955240000 'C:\WINDOWS\system32\SHCore.dll'
  1701. 504.6e0: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\WINDOWS\system32\wintab32.dll': 0 (NtPath=\??\C:\WINDOWS\system32\wintab32.dll; Input=C:\WINDOWS\system32\wintab32.dll; rcNtGetDll=0x0
  1702. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\WINDOWS\system32\wintab32.dll'
  1703. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1704. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'win32u.dll'.
  1705. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
  1706. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
  1707. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dwmapi.dll)
  1708. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dwmapi.dll
  1709. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff950830000 LB 0x0002a000 C:\WINDOWS\system32\dwmapi.dll [fFlags=0x0]
  1710. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dwmapi.dll [avoiding WinVerifyTrust]
  1711. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1712. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1713. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1714. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1715. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1716. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1717. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1718. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1719. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1720. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1721. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1722. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dwmapi.dll'
  1723. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1724. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1725. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\system32\winmm.dll'
  1726. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  1727. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1728. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\system32\winmm.dll'
  1729. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1730. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1731. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952f80000 'C:\WINDOWS\system32\shell32.dll'
  1732. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  1733. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1734. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9503f0000 'C:\WINDOWS\system32\uxtheme.dll'
  1735. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1736. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\advapi32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1737. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9548d0000 'C:\WINDOWS\system32\advapi32.dll'
  1738. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1739. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1740. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  1741. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'profapi.dll'.
  1742. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\userenv.dll) WinVerifyTrust
  1743. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\userenv.dll
  1744. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1745. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1746. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll
  1747. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1748. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1749. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\userenv.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1750. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
  1751. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff951d30000 LB 0x00029000 C:\WINDOWS\system32\userenv.dll [fFlags=0x0]
  1752. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
  1753. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff951d30000 'C:\WINDOWS\system32\userenv.dll'
  1754. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  1755. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1756. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955440000 'C:\WINDOWS\System32\kernel32.dll'
  1757. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff955940000 LB 0x0009e000 C:\WINDOWS\System32\clbcatq.dll [fFlags=0x0]
  1758. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1759. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'rpcrt4.dll'.
  1760. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\clbcatq.dll)
  1761. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\clbcatq.dll
  1762. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1763. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1764. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1765. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1766. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1767. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1768. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1769. 504.1698: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\clbcatq.dll'
  1770. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1771. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1772. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1773. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  1774. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1775. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1776. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1777. 504.1698: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
  1778. 504.1698: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  1779. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1780. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1781. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1782. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1783. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1784. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1785. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1786. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1787. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1788. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1789. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1790. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1791. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1792. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1793. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1794. 504.1698: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1795. 504.1698: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  1796. 504.1698: supR3HardenedDllNotificationCallback: load 00007ff91c460000 LB 0x00544000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  1797. 504.1698: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  1798. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff91c460000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  1799. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1800. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1801. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1802. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1803. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
  1804. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  1805. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  1806. 504.1698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1807. 504.1698: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
  1808. 504.1698: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1809. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1810. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1811. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1812. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1813. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1814. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1815. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1816. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  1817. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  1818. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  1819. 504.1698: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll [redoing WinVerifyTrust]
  1820. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1821. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1822. 504.1698: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'
  1823. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1824. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1825. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1826. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1827. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1828. 504.1698: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1829. 504.1698: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1830. 504.1698: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1831. 504.1698: supR3HardenedDllNotificationCallback: load 00007ff9454b0000 LB 0x000ba000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
  1832. 504.1698: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  1833. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9454b0000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
  1834. 504.1698: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1835. 504.1698: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1836. 504.1698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954af0000 'C:\Windows\System32\oleaut32.dll'
  1837. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  1838. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\gdi32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1839. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955a50000 'C:\WINDOWS\system32\gdi32.dll'
  1840. 504.1284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1841. 504.1284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1842. 504.1284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1843. 504.1284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1844. 504.1284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1845. 504.1284: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll) WinVerifyTrust
  1846. 504.1284: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  1847. 504.1284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1848. 504.1284: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1849. 504.1284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1850. 504.1284: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1851. 504.1284: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1852. 504.1284: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  1853. 504.1284: supR3HardenedDllNotificationCallback: load 00007ff950120000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [fFlags=0x0]
  1854. 504.1284: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  1855. 504.1284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff950120000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL'
  1856. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  1857. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1858. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952f80000 'C:\WINDOWS\system32\shell32.dll'
  1859. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff954980000 LB 0x00167000 C:\WINDOWS\System32\MSCTF.dll [fFlags=0x0]
  1860. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1861. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'oleaut32.dll'.
  1862. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'user32.dll'.
  1863. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
  1864. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'imm32.dll'.
  1865. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msctf.dll)
  1866. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msctf.dll
  1867. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1868. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1869. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
  1870. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1871. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1872. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1873. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1874. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1875. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1876. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  1877. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1878. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1879. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1880. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1881. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msctf.dll'
  1882. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a08 pwszName=\Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  1883. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  1884. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  1885. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87FA668FC207CB724FFDD342C6B5B8D273E3498D
  1886. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1887. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1888. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0010~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\DataExchange.dll'
  1889. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1890. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1891. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'shcore.dll'.
  1892. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'combase.dll'.
  1893. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'd3d11.dll'.
  1894. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'dcomp.dll'.
  1895. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\DataExchange.dll) WinVerifyTrust
  1896. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  1897. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
  1898. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' -> '\Device\HarddiskVolume3\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
  1899. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1900. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1901. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  1902. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1903. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dcomp.dll) WinVerifyTrust
  1904. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  1905. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
  1906. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume3\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
  1907. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1908. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1909. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1910. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1911. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1912. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1913. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1914. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1915. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'dxgi.dll'.
  1916. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'win32u.dll'.
  1917. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\d3d11.dll) WinVerifyTrust
  1918. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  1919. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  1920. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  1921. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [redoing WinVerifyTrust]
  1922. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  1923. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1924. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1925. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1926. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
  1927. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume3\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
  1928. 504.6e0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\dxgi.dll'.
  1929. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1930. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'win32u.dll'.
  1931. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dxgi.dll)
  1932. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dxgi.dll
  1933. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1934. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1935. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  1936. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  1937. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  1938. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1939. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1940. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1941. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  1942. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  1943. 504.6e0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\combase.dll'
  1944. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  1945. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  1946. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  1947. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1948. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1949. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  1950. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  1951. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  1952. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  1953. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll [avoiding WinVerifyTrust]
  1954. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff950c70000 LB 0x000af000 C:\WINDOWS\system32\dxgi.dll [fFlags=0x0]
  1955. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll [avoiding WinVerifyTrust]
  1956. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94f230000 LB 0x002e2000 C:\WINDOWS\system32\d3d11.dll [fFlags=0x0]
  1957. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  1958. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94fbf0000 LB 0x00142000 C:\WINDOWS\system32\dcomp.dll [fFlags=0x0]
  1959. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  1960. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff936e90000 LB 0x0004f000 C:\WINDOWS\system32\dataexchange.dll [fFlags=0x0]
  1961. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  1962. 504.6e0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\dxgi.dll'.
  1963. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\dxgi.dll' [rescheduled]
  1964. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff955a50000 'C:\WINDOWS\System32\gdi32.dll'
  1965. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff936e90000 'C:\WINDOWS\system32\dataexchange.dll'
  1966. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1967. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rmclient.dll'.
  1968. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
  1969. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'bcrypt.dll'.
  1970. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'combase.dll'.
  1971. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll)
  1972. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll
  1973. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1974. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  1975. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rmclient.dll)
  1976. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rmclient.dll
  1977. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9508d0000 LB 0x00020000 C:\WINDOWS\system32\RMCLIENT.dll [fFlags=0x0]
  1978. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rmclient.dll [avoiding WinVerifyTrust]
  1979. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff9506b0000 LB 0x0017b000 C:\WINDOWS\system32\twinapi.appcore.dll [fFlags=0x0]
  1980. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
  1981. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1982. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'coreuicomponents.dll'.
  1983. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'coremessaging.dll'.
  1984. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll)
  1985. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll
  1986. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1987. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'coremessaging.dll'.
  1988. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'shcore.dll'.
  1989. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll)
  1990. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll
  1991. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1992. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
  1993. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll)
  1994. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll
  1995. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntmarta.dll)
  1996. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntmarta.dll
  1997. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'combase.dll'.
  1998. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
  1999. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'bcryptprimitives.dll'.
  2000. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\WinTypes.dll)
  2001. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\WinTypes.dll
  2002. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff950f40000 LB 0x00031000 C:\WINDOWS\SYSTEM32\ntmarta.dll [fFlags=0x0]
  2003. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
  2004. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94f520000 LB 0x000dc000 C:\WINDOWS\System32\CoreMessaging.dll [fFlags=0x0]
  2005. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [avoiding WinVerifyTrust]
  2006. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94e6f0000 LB 0x00136000 C:\WINDOWS\SYSTEM32\wintypes.dll [fFlags=0x0]
  2007. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
  2008. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94bf00000 LB 0x002ee000 C:\WINDOWS\System32\CoreUIComponents.dll [fFlags=0x0]
  2009. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [avoiding WinVerifyTrust]
  2010. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff942a70000 LB 0x00098000 C:\WINDOWS\System32\TextInputFramework.dll [fFlags=0x0]
  2011. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll [avoiding WinVerifyTrust]
  2012. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  2013. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  2014. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  2015. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2016. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2017. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2018. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2019. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  2020. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2021. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2022. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2023. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2024. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  2025. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  2026. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  2027. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  2028. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  2029. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  2030. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2031. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2032. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  2033. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  2034. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  2035. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coreuicomponents.dll'...
  2036. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' -> '\Device\HarddiskVolume3\Windows\System32\coreuicomponents.dll' [rcNtRedir=0xc0150008]
  2037. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [lacks WinVerifyTrust]
  2038. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2039. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2040. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2041. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2042. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2043. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2044. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2045. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2046. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  2047. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  2048. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  2049. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  2050. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2051. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2052. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rmclient.dll'...
  2053. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rmclient.dll' -> '\Device\HarddiskVolume3\Windows\System32\rmclient.dll' [rcNtRedir=0xc0150008]
  2054. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rmclient.dll [lacks WinVerifyTrust]
  2055. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2056. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2057. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2058. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2059. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\WinTypes.dll'
  2060. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2061. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2062. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ntmarta.dll'
  2063. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2064. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2065. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll'
  2066. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2067. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2068. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll'
  2069. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2070. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2071. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll'
  2072. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2073. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2074. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rmclient.dll'
  2075. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2076. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2077. 504.6e0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll'
  2078. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2079. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\OLEAUT32.DLL (Input=OLEAUT32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2080. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954af0000 'C:\WINDOWS\System32\OLEAUT32.DLL'
  2081. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll) -> 0x0, fPresent=1
  2082. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2083. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954bc0000 'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll'
  2084. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll) -> 0x0, fPresent=1
  2085. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2086. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954bc0000 'ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll'
  2087. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-com-l1-1-0.dll) -> 0x0, fPresent=1
  2088. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-com-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2089. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9545c0000 'api-ms-win-core-com-l1-1-0.dll'
  2090. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
  2091. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2092. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954980000 'C:\WINDOWS\System32\MSCTF.dll'
  2093. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2094. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2095. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9552f0000 'C:\WINDOWS\System32\ole32.dll'
  2096. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2097. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\OLEAUT32.dll (Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2098. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954af0000 'C:\WINDOWS\System32\OLEAUT32.dll'
  2099. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b0c pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  2100. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2101. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2102. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AE2733DC030E44DCE443886E467FF179D2D68A91
  2103. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2104. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2105. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll'
  2106. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2107. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2108. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  2109. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
  2110. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
  2111. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  2112. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  2113. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  2114. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b18 pwszName=\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  2115. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2116. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2117. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CA3F9D85214DB0270185C719B931C69440BA9C18
  2118. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2119. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2120. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll'
  2121. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2122. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2123. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'bcrypt.dll'.
  2124. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'ws2_32.dll'.
  2125. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll) WinVerifyTrust
  2126. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  2127. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2128. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2129. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2130. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2131. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2132. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2133. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2134. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2135. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  2136. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  2137. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  2138. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2139. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2140. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2141. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  2142. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  2143. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94bb80000 LB 0x00081000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [fFlags=0x0]
  2144. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  2145. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94bcc0000 LB 0x0000f000 C:\WINDOWS\system32\wbem\wbemprox.dll [fFlags=0x0]
  2146. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  2147. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
  2148. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2149. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  2150. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94bcc0000 'C:\WINDOWS\system32\wbem\wbemprox.dll'
  2151. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b1c pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  2152. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2153. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2154. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4C70145BD7347C12AB1BF3946D40606389C4D331
  2155. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2156. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2157. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll'
  2158. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2159. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2160. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  2161. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
  2162. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  2163. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2164. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2165. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2166. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2167. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2168. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  2169. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94a1b0000 LB 0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [fFlags=0x0]
  2170. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  2171. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94a1b0000 'C:\WINDOWS\system32\wbem\wbemsvc.dll'
  2172. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
  2173. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2174. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-localization-l1-2-0.dll'
  2175. 504.6e0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
  2176. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2177. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952250000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
  2178. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b6c pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  2179. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2180. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2181. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=336CDD3C969CEFC6CE8D502298ED123FE8D2F483
  2182. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2183. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2184. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll'
  2185. 504.6e0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2186. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2187. 504.6e0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'wbemcomn.dll'.
  2188. 504.6e0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
  2189. 504.6e0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  2190. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  2191. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  2192. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  2193. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2194. 504.6e0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2195. 504.6e0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  2196. 504.6e0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2197. 504.6e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  2198. 504.6e0: supR3HardenedDllNotificationCallback: load 00007ff94a200000 LB 0x000f0000 C:\WINDOWS\system32\wbem\fastprox.dll [fFlags=0x0]
  2199. 504.6e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  2200. 504.6e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94a200000 'C:\WINDOWS\system32\wbem\fastprox.dll'
  2201. 504.233c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2202. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2203. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrem.dll'.
  2204. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2205. 504.233c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
  2206. 504.233c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2207. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2208. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2209. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrem.dll'...
  2210. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrem.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrem.dll' [rcNtRedir=0xc0150008]
  2211. 504.233c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2212. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
  2213. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2214. 504.233c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcrt.dll'.
  2215. 504.233c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxREM.dll) WinVerifyTrust
  2216. 504.233c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxREM.dll
  2217. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2218. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2219. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2220. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2221. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2222. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2223. 504.233c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2224. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2225. 504.233c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2226. 504.233c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2227. 504.233c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2228. 504.233c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxREM.dll
  2229. 504.233c: supR3HardenedDllNotificationCallback: load 0000000052e80000 LB 0x0010b000 C:\Program Files\Oracle\VirtualBox\VBoxREM.dll [fFlags=0x0]
  2230. 504.233c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxREM.dll
  2231. 504.233c: supR3HardenedDllNotificationCallback: load 00007ff9284c0000 LB 0x002c7000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
  2232. 504.233c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2233. 504.233c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9284c0000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  2234. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2235. 504.1094: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2236. 504.1094: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2237. 504.1094: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2238. 504.1094: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2239. 504.1094: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2240. 504.1094: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
  2241. 504.1094: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2242. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2243. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2244. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2245. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2246. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2247. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2248. 504.1094: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2249. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2250. 504.1094: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2251. 504.1094: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2252. 504.1094: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2253. 504.1094: supR3HardenedDllNotificationCallback: load 00007ff9500f0000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
  2254. 504.1094: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  2255. 504.1094: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9500f0000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
  2256. 504.1094: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff954bc0000 'C:\WINDOWS\system32\User32.dll'
  2257. 504.1c20: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2258. 504.1c20: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2259. 504.1c20: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2260. 504.1c20: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2261. 504.1c20: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
  2262. 504.1c20: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2263. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2264. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2265. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2266. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2267. 504.1c20: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2268. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2269. 504.1c20: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2270. 504.1c20: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2271. 504.1c20: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2272. 504.1c20: supR3HardenedDllNotificationCallback: load 00007ff950070000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
  2273. 504.1c20: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  2274. 504.1c20: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff950070000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
  2275. 504.22ac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2276. 504.22ac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2277. 504.22ac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2278. 504.22ac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2279. 504.22ac: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
  2280. 504.22ac: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  2281. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2282. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2283. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2284. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2285. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2286. 504.22ac: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2287. 504.22ac: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2288. 504.22ac: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2289. 504.22ac: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  2290. 504.22ac: supR3HardenedDllNotificationCallback: load 00007ff947ca0000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
  2291. 504.22ac: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  2292. 504.22ac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff947ca0000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
  2293. 504.2704: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2294. 504.2704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2295. 504.2704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  2296. 504.2704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2297. 504.2704: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
  2298. 504.2704: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  2299. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2300. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2301. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2302. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2303. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2304. 504.2704: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2305. 504.2704: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2306. 504.2704: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  2307. 504.2704: supR3HardenedDllNotificationCallback: load 00007ff945630000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
  2308. 504.2704: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  2309. 504.2704: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945630000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
  2310. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952f80000 'C:\WINDOWS\system32\Shell32.dll'
  2311. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2312. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2313. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9284c0000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  2314. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2315. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2316. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2317. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2318. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
  2319. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2320. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll) WinVerifyTrust
  2321. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2322. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2323. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2324. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2325. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2326. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2327. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2328. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2329. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2330. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2331. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2332. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2333. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2334. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2335. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93b740000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
  2336. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2337. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93b740000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
  2338. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93b740000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
  2339. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2340. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2341. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2342. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2343. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2344. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
  2345. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
  2346. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2347. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  2348. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
  2349. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
  2350. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
  2351. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
  2352. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2353. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  2354. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  2355. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL [redoing WinVerifyTrust]
  2356. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2357. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2358. 504.2194: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL'
  2359. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2360. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2361. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2362. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2363. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2364. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2365. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2366. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2367. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2368. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2369. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
  2370. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'cfgmgr32.dll'.
  2371. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\setupapi.dll) WinVerifyTrust
  2372. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  2373. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2374. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2375. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
  2376. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
  2377. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  2378. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  2379. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  2380. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2381. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2382. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2383. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2384. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2385. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2386. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2387. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
  2388. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2389. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
  2390. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
  2391. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2392. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2393. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2394. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2395. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2396. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2397. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2398. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2399. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
  2400. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  2401. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
  2402. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2403. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2404. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2405. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2406. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2407. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2408. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2409. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2410. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2411. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2412. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2413. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2414. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  2415. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2416. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2417. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2418. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2419. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2420. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2421. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2422. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2423. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2424. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2425. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff9554f0000 LB 0x0044e000 C:\WINDOWS\System32\SETUPAPI.dll [fFlags=0x0]
  2426. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  2427. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93a790000 LB 0x00063000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
  2428. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  2429. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff92c280000 LB 0x0005d000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
  2430. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2431. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff9194e0000 LB 0x009c2000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
  2432. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  2433. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9194e0000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
  2434. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2435. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2436. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2437. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2438. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93b740000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
  2439. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  2440. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93b740000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
  2441. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2442. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  2443. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2444. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff91c460000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
  2445. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2446. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  2447. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2448. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92c280000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
  2449. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2450. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2451. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2452. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2453. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll) WinVerifyTrust
  2454. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  2455. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2456. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2457. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2458. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2459. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2460. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  2461. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff945460000 LB 0x0001f000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [fFlags=0x0]
  2462. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  2463. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945460000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL'
  2464. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2465. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2466. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2467. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2468. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll) WinVerifyTrust
  2469. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  2470. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2471. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2472. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2473. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2474. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2475. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  2476. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93fe50000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [fFlags=0x0]
  2477. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  2478. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93fe50000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL'
  2479. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2480. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2481. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2482. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2483. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll) WinVerifyTrust
  2484. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  2485. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2486. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2487. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2488. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2489. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2490. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  2491. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93bec0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [fFlags=0x0]
  2492. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  2493. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93bec0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL'
  2494. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2495. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2496. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2497. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2498. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll) WinVerifyTrust
  2499. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  2500. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2501. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2502. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2503. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2504. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2505. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  2506. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93ae60000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [fFlags=0x0]
  2507. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  2508. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93ae60000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL'
  2509. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2510. 504.8a0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2511. 504.8a0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2512. 504.8a0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  2513. 504.8a0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2514. 504.8a0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
  2515. 504.8a0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2516. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2517. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2518. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  2519. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  2520. 504.8a0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2521. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2522. 504.8a0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2523. 504.8a0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2524. 504.8a0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2525. 504.8a0: supR3HardenedDllNotificationCallback: load 00007ff9455d0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
  2526. 504.8a0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  2527. 504.8a0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9455d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
  2528. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2529. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2530. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  2531. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  2532. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2533. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  2534. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  2535. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll) WinVerifyTrust
  2536. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  2537. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2538. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2539. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2540. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2541. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2542. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2543. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2544. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2545. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2546. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2547. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2548. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2549. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  2550. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff92bda0000 LB 0x000cc000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL [fFlags=0x0]
  2551. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  2552. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92bda0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL'
  2553. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  2554. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Iphlpapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2555. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff951420000 'C:\WINDOWS\system32\Iphlpapi.dll'
  2556. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  2557. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
  2558. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winnsi.dll)
  2559. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winnsi.dll
  2560. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff955070000 LB 0x00008000 C:\WINDOWS\System32\NSI.dll [fFlags=0x0]
  2561. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\nsi.dll)
  2562. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\nsi.dll
  2563. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94c790000 LB 0x0000b000 C:\WINDOWS\SYSTEM32\WINNSI.DLL [fFlags=0x0]
  2564. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
  2565. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  2566. 504.2194: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll)
  2567. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll
  2568. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94c680000 LB 0x00016000 C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL [fFlags=0x0]
  2569. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll [avoiding WinVerifyTrust]
  2570. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  2571. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
  2572. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'nsi.dll'.
  2573. 504.2194: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll)
  2574. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll
  2575. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94c660000 LB 0x0001a000 C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL [fFlags=0x0]
  2576. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll [avoiding WinVerifyTrust]
  2577. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000efc pwszName=\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll
  2578. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2579. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2580. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A0979042666D2FF6A450082A737154F788178270
  2581. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  2582. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  2583. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\nsi.dll [lacks WinVerifyTrust]
  2584. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2585. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2586. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2587. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2588. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2589. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2590. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2591. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  2592. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  2593. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\nsi.dll [lacks WinVerifyTrust]
  2594. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2595. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2596. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2597. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2598. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0015~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll'
  2599. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2600. 504.2194: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll'
  2601. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ef0 pwszName=\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll
  2602. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2603. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2604. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=839F90BCFF138802B805D9F6439239CC98023804
  2605. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2606. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  2607. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2608. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2609. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0015~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll'
  2610. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2611. 504.2194: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll'
  2612. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2613. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2614. 504.2194: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\nsi.dll'
  2615. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2616. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2617. 504.2194: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\winnsi.dll'
  2618. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2619. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2620. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2621. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  2622. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'devobj.dll'.
  2623. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'propsys.dll'.
  2624. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll) WinVerifyTrust
  2625. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2626. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
  2627. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume3\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
  2628. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2629. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2630. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2631. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'oleaut32.dll'.
  2632. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
  2633. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\propsys.dll) WinVerifyTrust
  2634. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\propsys.dll
  2635. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  2636. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume3\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  2637. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2638. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2639. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2640. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2641. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2642. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2643. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2644. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2645. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'cfgmgr32.dll'.
  2646. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\devobj.dll) WinVerifyTrust
  2647. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\devobj.dll
  2648. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2649. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2650. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2651. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2652. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  2653. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  2654. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll [redoing WinVerifyTrust]
  2655. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2656. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2657. 504.2194: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'
  2658. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2659. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2660. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
  2661. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\propsys.dll
  2662. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff951c10000 LB 0x00027000 C:\WINDOWS\System32\DEVOBJ.dll [fFlags=0x0]
  2663. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
  2664. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94db20000 LB 0x001b1000 C:\WINDOWS\System32\PROPSYS.dll [fFlags=0x0]
  2665. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\propsys.dll
  2666. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94b890000 LB 0x0006f000 C:\WINDOWS\System32\MMDevApi.dll [fFlags=0x0]
  2667. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2668. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94b890000 'C:\WINDOWS\System32\MMDevApi.dll'
  2669. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fb8 pwszName=\Device\HarddiskVolume3\Windows\System32\dsound.dll
  2670. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2671. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2672. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=149E0A5A40CD1471B9EF3D3043A8C754805FEC76
  2673. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2674. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2675. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\dsound.dll'
  2676. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2677. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2678. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'winmm.dll'.
  2679. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dsound.dll) WinVerifyTrust
  2680. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2681. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2682. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2683. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2684. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2685. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2686. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2687. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2688. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff92b600000 LB 0x0008f000 C:\WINDOWS\System32\dsound.dll [fFlags=0x0]
  2689. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2690. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2691. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2692. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\System32\dsound.dll'
  2693. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\System32\dsound.dll'
  2694. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2695. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2696. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2697. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2698. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2699. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94b890000 'C:\WINDOWS\System32\MMDEVAPI.DLL'
  2700. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2701. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2702. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2703. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fe8 pwszName=\Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2704. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2705. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2706. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=47392EB8EC6AC07C788B971D8BB592B6FD619920
  2707. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2708. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2709. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\wdmaud.drv'
  2710. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2711. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2712. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'mmdevapi.dll'.
  2713. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'ksuser.dll'.
  2714. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'avrt.dll'.
  2715. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wdmaud.drv) WinVerifyTrust
  2716. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2717. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
  2718. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
  2719. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2720. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2721. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\avrt.dll) WinVerifyTrust
  2722. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\avrt.dll
  2723. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ksuser.dll'...
  2724. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'ksuser.dll' -> '\Device\HarddiskVolume3\Windows\System32\ksuser.dll' [rcNtRedir=0xc0150008]
  2725. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2726. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2727. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2728. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ksuser.dll) WinVerifyTrust
  2729. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ksuser.dll
  2730. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  2731. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  2732. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2733. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2734. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2735. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2736. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2737. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2738. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2739. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ksuser.dll
  2740. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
  2741. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94ea30000 LB 0x00009000 C:\WINDOWS\SYSTEM32\ksuser.dll [fFlags=0x0]
  2742. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ksuser.dll
  2743. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff94d8c0000 LB 0x0000a000 C:\WINDOWS\SYSTEM32\AVRT.dll [fFlags=0x0]
  2744. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
  2745. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93a5c0000 LB 0x00042000 C:\WINDOWS\System32\wdmaud.drv [fFlags=0x0]
  2746. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2747. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2748. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2749. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2750. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2751. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2752. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2753. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2754. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2755. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2756. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2757. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2758. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2759. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2760. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2761. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2762. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  2763. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
  2764. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
  2765. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #55 'mmdevapi.dll'.
  2766. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'avrt.dll'.
  2767. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\AudioSes.dll) WinVerifyTrust
  2768. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  2769. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
  2770. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
  2771. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
  2772. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  2773. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  2774. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2775. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2776. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2777. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2778. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2779. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2780. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2781. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  2782. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2783. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2784. 504.2194: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'
  2785. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2786. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  2787. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff944d80000 LB 0x00122000 C:\WINDOWS\System32\AUDIOSES.DLL [fFlags=0x0]
  2788. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  2789. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff944d80000 'C:\WINDOWS\System32\AUDIOSES.DLL'
  2790. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2791. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2792. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2793. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
  2794. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2795. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2796. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2797. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2798. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2799. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2800. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2801. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2802. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff93a5c0000 'C:\WINDOWS\System32\wdmaud.drv'
  2803. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000f00 pwszName=\Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2804. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2805. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2806. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8069FA07F8A743E03BD7E2DA392DE4429701D8E6
  2807. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2808. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2809. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\msacm32.drv'
  2810. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2811. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2812. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'mmdevapi.dll'.
  2813. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'msacm32.dll'.
  2814. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'winmmbase.dll'.
  2815. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msacm32.drv) WinVerifyTrust
  2816. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2817. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
  2818. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
  2819. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll [redoing WinVerifyTrust]
  2820. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2821. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2822. 504.2194: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'
  2823. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msacm32.dll'...
  2824. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msacm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\msacm32.dll' [rcNtRedir=0xc0150008]
  2825. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2826. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2827. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2828. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msacm32.dll) WinVerifyTrust
  2829. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msacm32.dll
  2830. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  2831. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  2832. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  2833. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2834. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2835. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2836. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2837. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2838. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2839. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.dll
  2840. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff93ad50000 LB 0x0001c000 C:\WINDOWS\SYSTEM32\MSACM32.dll [fFlags=0x0]
  2841. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.dll
  2842. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff945420000 LB 0x0000c000 C:\WINDOWS\System32\msacm32.drv [fFlags=0x0]
  2843. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2844. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2845. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2846. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2847. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2848. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2849. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2850. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2851. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2852. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2853. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2854. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2855. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2856. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2857. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2858. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2859. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2860. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
  2861. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2862. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2863. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2864. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2865. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff945420000 'C:\WINDOWS\System32\msacm32.drv'
  2866. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001048 pwszName=\Device\HarddiskVolume3\Windows\System32\midimap.dll
  2867. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2868. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2869. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=725292B88FCE45C617EE0258A333B14CA2D7EF04
  2870. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2871. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2872. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat'; file='\Device\HarddiskVolume3\Windows\System32\midimap.dll'
  2873. 504.2194: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2874. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2875. 504.2194: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winmm.dll'.
  2876. 504.2194: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\midimap.dll) WinVerifyTrust
  2877. 504.2194: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2878. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2879. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2880. 504.2194: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2881. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2882. 504.2194: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2883. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2884. 504.2194: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2885. 504.2194: supR3HardenedDllNotificationCallback: load 00007ff943420000 LB 0x0000a000 C:\WINDOWS\System32\midimap.dll [fFlags=0x0]
  2886. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2887. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff943420000 'C:\WINDOWS\System32\midimap.dll'
  2888. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2889. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2890. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff943420000 'C:\WINDOWS\System32\midimap.dll'
  2891. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2892. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2893. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff943420000 'C:\WINDOWS\System32\midimap.dll'
  2894. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
  2895. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
  2896. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff943420000 'C:\WINDOWS\System32\midimap.dll'
  2897. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2898. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2899. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2900. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2901. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2902. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2903. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2904. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2905. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2906. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2907. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2908. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2909. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2910. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2911. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2912. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2913. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2914. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2915. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2916. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2917. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2918. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2919. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2920. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  2921. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2922. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9284c0000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  2923. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2924. 504.ac4: '\Device\HarddiskVolume3\Windows\System32\tzres.dll' has no imports
  2925. 504.ac4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\tzres.dll)
  2926. 504.ac4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\tzres.dll
  2927. 504.ac4: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001258 (hFile=0000000000001274) with 0xc0000022 -> STATUS_TRUST_FAILURE
  2928. 504.ac4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\tzres.dll [avoiding WinVerifyTrust]
  2929. 504.ac4: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001274 (hFile=0000000000001258) with 0xc0000022 -> STATUS_TRUST_FAILURE
  2930. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000126c pwszName=\Device\HarddiskVolume3\Windows\System32\tzres.dll
  2931. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000030894d0
  2932. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000030894d0
  2933. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952050000 'C:\Windows\System32\WINTRUST.DLL'
  2934. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\CRYPT32.dll'
  2935. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0206821D153D3380EC7FACEFBF7AE60B7B8A2F1D
  2936. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2937. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2938. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_587_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat'; file='\Device\HarddiskVolume3\Windows\System32\tzres.dll'
  2939. 504.ac4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2940. 504.ac4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\tzres.dll'
  2941. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2942. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2943. 504.ac4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'ws2_32.dll'.
  2944. 504.ac4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
  2945. 504.ac4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mswsock.dll) WinVerifyTrust
  2946. 504.ac4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  2947. 504.ac4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2948. 504.ac4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2949. 504.ac4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2950. 504.ac4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2951. 504.ac4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2952. 504.ac4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\mswsock.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2953. 504.ac4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  2954. 504.ac4: supR3HardenedDllNotificationCallback: load 00007ff951690000 LB 0x00066000 C:\WINDOWS\system32\mswsock.dll [fFlags=0x0]
  2955. 504.ac4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  2956. 504.ac4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff951690000 'C:\WINDOWS\system32\mswsock.dll'
  2957. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  2958. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2959. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2960. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2961. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  2962. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  2963. 504.12ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2964. 504.12ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2965. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2966. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  2967. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'combase.dll'.
  2968. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'shcore.dll'.
  2969. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'win32u.dll'.
  2970. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'textinputframework.dll'.
  2971. 504.12ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'user32.dll'.
  2972. 504.12ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\Windows.UI.dll) WinVerifyTrust
  2973. 504.12ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\Windows.UI.dll
  2974. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2975. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2976. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'textinputframework.dll'...
  2977. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'textinputframework.dll' -> '\Device\HarddiskVolume3\Windows\System32\textinputframework.dll' [rcNtRedir=0xc0150008]
  2978. 504.12ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll
  2979. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2980. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2981. 504.12ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  2982. 504.12ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9512a0000 'C:\WINDOWS\system32\rsaenh.dll'
  2983. 504.12ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff952c10000 'C:\WINDOWS\System32\crypt32.dll'
  2984. 504.12ec: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll'
  2985. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  2986. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  2987. 504.12ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  2988. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2989. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2990. 504.12ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  2991. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2992. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2993. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2994. 504.12ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2995. 504.12ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\Windows.UI.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  2996. 504.12ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\Windows.UI.dll
  2997. 504.12ec: supR3HardenedDllNotificationCallback: load 00007ff942b10000 LB 0x00107000 C:\Windows\System32\Windows.UI.dll [fFlags=0x0]
  2998. 504.12ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\Windows.UI.dll
  2999. 504.12ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff942b10000 'C:\Windows\System32\Windows.UI.dll'
  3000. 504.17d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
  3001. 504.17d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\avrt.dll (Input=avrt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3002. 504.17d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94d8c0000 'C:\WINDOWS\System32\avrt.dll'
  3003. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3004. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3005. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3006. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3007. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3008. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3009. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3010. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3011. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3012. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3013. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3014. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3015. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
  3016. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3017. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3018. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3019. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3020. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3021. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3022. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3023. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3024. 504.2194: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  3025. 504.2194: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3026. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3027. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3028. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3029. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3030. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3031. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3032. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3033. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff92b600000 'C:\WINDOWS\system32\dsound.dll'
  3034. 504.2194: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff94e9b0000 'C:\WINDOWS\System32\winmm.dll'
  3035. 504.8a0: supR3HardenedDllNotificationCallback: Unload 00007ff9455d0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [flags=0x0]
  3036. 504.2704: supR3HardenedDllNotificationCallback: Unload 00007ff945630000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [flags=0x0]
  3037. 504.22ac: supR3HardenedDllNotificationCallback: Unload 00007ff947ca0000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [flags=0x0]
  3038. 504.1c20: supR3HardenedDllNotificationCallback: Unload 00007ff950070000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [flags=0x0]
  3039. 504.1094: supR3HardenedDllNotificationCallback: Unload 00007ff9500f0000 LB 0x0000b000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [flags=0x0]
  3040. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93ae60000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [flags=0x0]
  3041. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93bec0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [flags=0x0]
  3042. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93fe50000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [flags=0x0]
  3043. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff945460000 LB 0x0001f000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [flags=0x0]
  3044. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93b740000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
  3045. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff9194e0000 LB 0x009c2000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [flags=0x0]
  3046. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff93a790000 LB 0x00063000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [flags=0x0]
  3047. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff92c280000 LB 0x0005d000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [flags=0x0]
  3048. 504.2194: supR3HardenedDllNotificationCallback: Unload 00007ff9554f0000 LB 0x0044e000 C:\WINDOWS\System32\SETUPAPI.dll [flags=0x0]
  3049. 504.6e0: supR3HardenedDllNotificationCallback: Unload 00007ff950120000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [flags=0x0]
  3050. 504.6e0: Terminating the normal way: rcExit=0
  3051. 1cb8.1fc8: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 312863 ms, the end);
  3052. 1b14.205c: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 313282 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!