API tools faq
paste
Advertisement
funkytwig

Untitled

funkytwig
Dec 24th, 2021
41
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 444.67 KB | None | 0 0
raw download clone embed print report
  1. 27c8.36b8: Log file opened: 6.1.30r148432 g_hStartupLog=000000000000008c g_uNtVerCombined=0xa04a6400
  2. 27c8.36b8: \SystemRoot\System32\ntdll.dll:
  3. 27c8.36b8: CreationTime: 2021-10-06T13:39:54.967473200Z
  4. 27c8.36b8: LastWriteTime: 2021-10-06T13:39:55.014335100Z
  5. 27c8.36b8: ChangeTime: 2021-12-17T09:52:47.850888900Z
  6. 27c8.36b8: FileAttributes: 0x20
  7. 27c8.36b8: Size: 0x1ee520
  8. 27c8.36b8: NT Headers: 0xe8
  9. 27c8.36b8: Timestamp: 0xa280d1d6
  10. 27c8.36b8: Machine: 0x8664 - amd64
  11. 27c8.36b8: Timestamp: 0xa280d1d6
  12. 27c8.36b8: Image Version: 10.0
  13. 27c8.36b8: SizeOfImage: 0x1f5000 (2052096)
  14. 27c8.36b8: Resource Dir: 0x184000 LB 0x6fdc8
  15. 27c8.36b8: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 27c8.36b8: [Raw version resource data: 0x1840f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 27c8.36b8: ProductName: Microsoft® Windows® Operating System
  18. 27c8.36b8: ProductVersion: 10.0.19041.1288
  19. 27c8.36b8: FileVersion: 10.0.19041.1288 (WinBuild.160101.0800)
  20. 27c8.36b8: FileDescription: NT Layer DLL
  21. 27c8.36b8: \SystemRoot\System32\kernel32.dll:
  22. 27c8.36b8: CreationTime: 2021-12-02T15:03:52.492099300Z
  23. 27c8.36b8: LastWriteTime: 2021-12-02T15:03:52.505102200Z
  24. 27c8.36b8: ChangeTime: 2021-12-17T09:52:47.655061900Z
  25. 27c8.36b8: FileAttributes: 0x20
  26. 27c8.36b8: Size: 0xbc058
  27. 27c8.36b8: NT Headers: 0xe8
  28. 27c8.36b8: Timestamp: 0x38b369c4
  29. 27c8.36b8: Machine: 0x8664 - amd64
  30. 27c8.36b8: Timestamp: 0x38b369c4
  31. 27c8.36b8: Image Version: 10.0
  32. 27c8.36b8: SizeOfImage: 0xbe000 (778240)
  33. 27c8.36b8: Resource Dir: 0xbc000 LB 0x520
  34. 27c8.36b8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 27c8.36b8: [Raw version resource data: 0xbc0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 27c8.36b8: ProductName: Microsoft® Windows® Operating System
  37. 27c8.36b8: ProductVersion: 10.0.19041.1348
  38. 27c8.36b8: FileVersion: 10.0.19041.1348 (WinBuild.160101.0800)
  39. 27c8.36b8: FileDescription: Windows NT BASE API Client DLL
  40. 27c8.36b8: \SystemRoot\System32\KernelBase.dll:
  41. 27c8.36b8: CreationTime: 2021-12-17T09:52:07.022047900Z
  42. 27c8.36b8: LastWriteTime: 2021-12-17T09:52:07.089062400Z
  43. 27c8.36b8: ChangeTime: 2021-12-18T17:56:07.323012400Z
  44. 27c8.36b8: FileAttributes: 0x20
  45. 27c8.36b8: Size: 0x2c9168
  46. 27c8.36b8: NT Headers: 0xf0
  47. 27c8.36b8: Timestamp: 0xb9a844a
  48. 27c8.36b8: Machine: 0x8664 - amd64
  49. 27c8.36b8: Timestamp: 0xb9a844a
  50. 27c8.36b8: Image Version: 10.0
  51. 27c8.36b8: SizeOfImage: 0x2c8000 (2916352)
  52. 27c8.36b8: Resource Dir: 0x29f000 LB 0x548
  53. 27c8.36b8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 27c8.36b8: [Raw version resource data: 0x29f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  55. 27c8.36b8: ProductName: Microsoft® Windows® Operating System
  56. 27c8.36b8: ProductVersion: 10.0.19041.1387
  57. 27c8.36b8: FileVersion: 10.0.19041.1387 (WinBuild.160101.0800)
  58. 27c8.36b8: FileDescription: Windows NT BASE API Client DLL
  59. 27c8.36b8: \SystemRoot\System32\apisetschema.dll:
  60. 27c8.36b8: CreationTime: 2019-12-07T09:08:13.518339400Z
  61. 27c8.36b8: LastWriteTime: 2019-12-07T09:08:13.518339400Z
  62. 27c8.36b8: ChangeTime: 2021-12-17T09:52:47.633058800Z
  63. 27c8.36b8: FileAttributes: 0x20
  64. 27c8.36b8: Size: 0x1f538
  65. 27c8.36b8: NT Headers: 0xd0
  66. 27c8.36b8: Timestamp: 0x31288ce0
  67. 27c8.36b8: Machine: 0x8664 - amd64
  68. 27c8.36b8: Timestamp: 0x31288ce0
  69. 27c8.36b8: Image Version: 10.0
  70. 27c8.36b8: SizeOfImage: 0x20000 (131072)
  71. 27c8.36b8: Resource Dir: 0x1f000 LB 0x408
  72. 27c8.36b8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 27c8.36b8: [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  74. 27c8.36b8: ProductName: Microsoft® Windows® Operating System
  75. 27c8.36b8: ProductVersion: 10.0.19041.1
  76. 27c8.36b8: FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
  77. 27c8.36b8: FileDescription: ApiSet Schema DLL
  78. 27c8.36b8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 27c8.36b8: supR3HardenedWinFindAdversaries: 0x0
  80. 27c8.36b8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  81. 27c8.36b8: Calling main()
  82. 27c8.36b8: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  83. 27c8.36b8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  84. 27c8.36b8: SUPR3HardenedMain: Respawn #1
  85. 27c8.36b8: System32: \Device\HarddiskVolume3\Windows\System32
  86. 27c8.36b8: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  87. 27c8.36b8: KnownDllPath: C:\WINDOWS\System32
  88. 27c8.36b8: supR3HardenedWinInit: Performing a limited self purification...
  89. 27c8.36b8: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
  90. 27c8.36b8: *0000000000000000-000000000088ffff 0x0001/0x0000 0x0000000
  91. 27c8.36b8: *0000000000890000-000000000089ffff 0x0004/0x0004 0x0040000
  92. 27c8.36b8: *00000000008a0000-00000000008a0fff 0x0002/0x0002 0x0040000
  93. 27c8.36b8: 00000000008a1000-00000000008affff 0x0001/0x0000 0x0000000
  94. 27c8.36b8: *00000000008b0000-00000000008ccfff 0x0002/0x0002 0x0040000
  95. 27c8.36b8: 00000000008cd000-00000000008cffff 0x0001/0x0000 0x0000000
  96. 27c8.36b8: *00000000008d0000-0000000000988fff 0x0000/0x0004 0x0020000
  97. 27c8.36b8: 0000000000989000-000000000098bfff 0x0104/0x0004 0x0020000
  98. 27c8.36b8: 000000000098c000-00000000009cffff 0x0004/0x0004 0x0020000
  99. 27c8.36b8: *00000000009d0000-00000000009d3fff 0x0002/0x0002 0x0040000
  100. 27c8.36b8: 00000000009d4000-00000000009dffff 0x0001/0x0000 0x0000000
  101. 27c8.36b8: *00000000009e0000-00000000009e1fff 0x0004/0x0004 0x0020000
  102. 27c8.36b8: 00000000009e2000-00000000009effff 0x0001/0x0000 0x0000000
  103. 27c8.36b8: *00000000009f0000-00000000009f0fff 0x0002/0x0002 0x0040000
  104. 27c8.36b8: 00000000009f1000-00000000009fffff 0x0001/0x0000 0x0000000
  105. 27c8.36b8: *0000000000a00000-0000000000a9cfff 0x0000/0x0004 0x0020000
  106. 27c8.36b8: 0000000000a9d000-0000000000a9ffff 0x0004/0x0004 0x0020000
  107. 27c8.36b8: 0000000000aa0000-0000000000bfffff 0x0000/0x0004 0x0020000
  108. 27c8.36b8: *0000000000c00000-0000000000cc8fff 0x0002/0x0002 0x0040000
  109. 27c8.36b8: 0000000000cc9000-0000000000ccffff 0x0001/0x0000 0x0000000
  110. 27c8.36b8: *0000000000cd0000-0000000000cd6fff 0x0004/0x0004 0x0020000
  111. 27c8.36b8: 0000000000cd7000-0000000000dcffff 0x0000/0x0004 0x0020000
  112. 27c8.36b8: *0000000000dd0000-0000000000dd0fff 0x0004/0x0004 0x0020000
  113. 27c8.36b8: 0000000000dd1000-0000000000ddffff 0x0001/0x0000 0x0000000
  114. 27c8.36b8: *0000000000de0000-0000000000de0fff 0x0002/0x0004 0x0020000
  115. 27c8.36b8: 0000000000de1000-0000000000de1fff 0x0020/0x0004 0x0020000 !!
  116. 27c8.36b8: 0000000000de2000-0000000000deffff 0x0001/0x0000 0x0000000
  117. 27c8.36b8: *0000000000df0000-0000000000df1fff 0x0004/0x0004 0x0020000
  118. 27c8.36b8: 0000000000df2000-0000000000e51fff 0x0000/0x0004 0x0020000
  119. 27c8.36b8: 0000000000e52000-0000000000e5ffff 0x0001/0x0000 0x0000000
  120. 27c8.36b8: *0000000000e60000-0000000000e60fff 0x0002/0x0004 0x0020000
  121. 27c8.36b8: 0000000000e61000-0000000000e61fff 0x0020/0x0004 0x0020000 !!
  122. 27c8.36b8: 0000000000e62000-0000000000e6ffff 0x0001/0x0000 0x0000000
  123. 27c8.36b8: *0000000000e70000-0000000000e70fff 0x0004/0x0004 0x0020000
  124. 27c8.36b8: 0000000000e71000-0000000000e7ffff 0x0001/0x0000 0x0000000
  125. 27c8.36b8: *0000000000e80000-0000000000e81fff 0x0004/0x0004 0x0020000
  126. 27c8.36b8: 0000000000e82000-0000000000ee1fff 0x0000/0x0004 0x0020000
  127. 27c8.36b8: 0000000000ee2000-0000000000eeffff 0x0001/0x0000 0x0000000
  128. 27c8.36b8: *0000000000ef0000-0000000000ef1fff 0x0004/0x0004 0x0020000
  129. 27c8.36b8: 0000000000ef2000-0000000000f51fff 0x0000/0x0004 0x0020000
  130. 27c8.36b8: 0000000000f52000-0000000000f9ffff 0x0001/0x0000 0x0000000
  131. 27c8.36b8: *0000000000fa0000-000000000105ffff 0x0004/0x0004 0x0020000
  132. 27c8.36b8: 0000000001060000-000000000106ffff 0x0000/0x0004 0x0020000
  133. 27c8.36b8: *0000000001070000-0000000001071fff 0x0004/0x0004 0x0020000
  134. 27c8.36b8: 0000000001072000-00000000010d1fff 0x0000/0x0004 0x0020000
  135. 27c8.36b8: 00000000010d2000-00000000010dffff 0x0001/0x0000 0x0000000
  136. 27c8.36b8: *00000000010e0000-00000000010e1fff 0x0004/0x0004 0x0020000
  137. 27c8.36b8: 00000000010e2000-0000000001141fff 0x0000/0x0004 0x0020000
  138. 27c8.36b8: 0000000001142000-000000000118ffff 0x0001/0x0000 0x0000000
  139. 27c8.36b8: *0000000001190000-000000000124ffff 0x0004/0x0004 0x0020000
  140. 27c8.36b8: 0000000001250000-000000000125ffff 0x0000/0x0004 0x0020000
  141. 27c8.36b8: 0000000001260000-00000000012cffff 0x0001/0x0000 0x0000000
  142. 27c8.36b8: *00000000012d0000-00000000012d4fff 0x0004/0x0004 0x0020000
  143. 27c8.36b8: 00000000012d5000-00000000016cffff 0x0000/0x0004 0x0020000
  144. 27c8.36b8: *00000000016d0000-00000000016f6fff 0x0004/0x0004 0x0020000
  145. 27c8.36b8: 00000000016f7000-00000000017cffff 0x0000/0x0004 0x0020000
  146. 27c8.36b8: 00000000017d0000-00000000017dffff 0x0001/0x0000 0x0000000
  147. 27c8.36b8: *00000000017e0000-000000000180ffff 0x0004/0x0004 0x0020000
  148. 27c8.36b8: 0000000001810000-0000000001bdffff 0x0000/0x0004 0x0020000
  149. 27c8.36b8: 0000000001be0000-0000000001daffff 0x0001/0x0000 0x0000000
  150. 27c8.36b8: *0000000001db0000-0000000001dbefff 0x0004/0x0004 0x0020000
  151. 27c8.36b8: 0000000001dbf000-0000000001dbffff 0x0000/0x0004 0x0020000
  152. 27c8.36b8: *0000000001dc0000-0000000001dc6fff 0x0000/0x0004 0x0020000
  153. 27c8.36b8: 0000000001dc7000-0000000001fbcfff 0x0004/0x0004 0x0020000
  154. 27c8.36b8: 0000000001fbd000-0000000001fbdfff 0x0000/0x0004 0x0020000
  155. 27c8.36b8: 0000000001fbe000-000000007ffdffff 0x0001/0x0000 0x0000000
  156. 27c8.36b8: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  157. 27c8.36b8: 000000007ffe1000-000000007ffeafff 0x0001/0x0000 0x0000000
  158. 27c8.36b8: *000000007ffeb000-000000007ffebfff 0x0002/0x0002 0x0020000
  159. 27c8.36b8: 000000007ffec000-00007ff4e38cffff 0x0001/0x0000 0x0000000
  160. 27c8.36b8: *00007ff4e38d0000-00007ff4e38d0fff 0x0004/0x0004 0x0020000
  161. 27c8.36b8: 00007ff4e38d1000-00007ff4e38dffff 0x0001/0x0000 0x0000000
  162. 27c8.36b8: *00007ff4e38e0000-00007ff4e38effff 0x0002/0x0002 0x0020000
  163. 27c8.36b8: *00007ff4e38f0000-00007ff4e38f0fff 0x0002/0x0002 0x0020000
  164. 27c8.36b8: 00007ff4e38f1000-00007ff4e38f2fff 0x0020/0x0002 0x0020000 !!
  165. 27c8.36b8: 00007ff4e38f3000-00007ff4e38fffff 0x0001/0x0000 0x0000000
  166. 27c8.36b8: *00007ff4e3900000-00007ff4e3904fff 0x0002/0x0002 0x0040000
  167. 27c8.36b8: 00007ff4e3905000-00007ff4e39fffff 0x0000/0x0002 0x0040000
  168. 27c8.36b8: *00007ff4e3a00000-00007ff5e3a1ffff 0x0000/0x0004 0x0020000
  169. 27c8.36b8: *00007ff5e3a20000-00007ff5e5a1ffff 0x0000/0x0004 0x0020000
  170. 27c8.36b8: 00007ff5e5a20000-00007ff5e5a20fff 0x0004/0x0004 0x0020000
  171. 27c8.36b8: 00007ff5e5a21000-00007ff5e5a2ffff 0x0001/0x0000 0x0000000
  172. 27c8.36b8: *00007ff5e5a30000-00007ff5e5a30fff 0x0020/0x0004 0x0020000 !!
  173. 27c8.36b8: 00007ff5e5a31000-00007ff5e5a3ffff 0x0001/0x0000 0x0000000
  174. 27c8.36b8: *00007ff5e5a40000-00007ff5e5a40fff 0x0002/0x0002 0x0040000
  175. 27c8.36b8: 00007ff5e5a41000-00007ff5e5a4ffff 0x0001/0x0000 0x0000000
  176. 27c8.36b8: *00007ff5e5a50000-00007ff5e5a72fff 0x0002/0x0002 0x0040000
  177. 27c8.36b8: 00007ff5e5a73000-00007ff7ac75ffff 0x0001/0x0000 0x0000000
  178. 27c8.36b8: *00007ff7ac760000-00007ff7ac760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  179. 27c8.36b8: 00007ff7ac761000-00007ff7ac7d7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  180. 27c8.36b8: 00007ff7ac7d8000-00007ff7ac7d8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  181. 27c8.36b8: 00007ff7ac7d9000-00007ff7ac821fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  182. 27c8.36b8: 00007ff7ac822000-00007ff7ac824fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  183. 27c8.36b8: 00007ff7ac825000-00007ff7ac827fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  184. 27c8.36b8: 00007ff7ac828000-00007ff7ac82afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  185. 27c8.36b8: 00007ff7ac82b000-00007ff7ac82bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  186. 27c8.36b8: 00007ff7ac82c000-00007ff7ac82dfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  187. 27c8.36b8: 00007ff7ac82e000-00007ff7ac82efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  188. 27c8.36b8: 00007ff7ac82f000-00007ff7ac877fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  189. 27c8.36b8: 00007ff7ac878000-00007ffdbf41ffff 0x0001/0x0000 0x0000000
  190. 27c8.36b8: *00007ffdbf420000-00007ffdbf420fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  191. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf420000 LB 0x1000 (base 00007ffdbf420000) - 'atcuf64.dll'
  192. 27c8.36b8: 00007ffdbf421000-00007ffdbf480fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  193. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf421000 LB 0x60000 (base 00007ffdbf420000) - 'atcuf64.dll'
  194. 27c8.36b8: 00007ffdbf481000-00007ffdbf50efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  195. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf481000 LB 0x8e000 (base 00007ffdbf420000) - 'atcuf64.dll'
  196. 27c8.36b8: 00007ffdbf50f000-00007ffdbf515fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  197. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf50f000 LB 0x7000 (base 00007ffdbf420000) - 'atcuf64.dll'
  198. 27c8.36b8: 00007ffdbf516000-00007ffdbf516fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  199. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf516000 LB 0x1000 (base 00007ffdbf420000) - 'atcuf64.dll'
  200. 27c8.36b8: 00007ffdbf517000-00007ffdbf51efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  201. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf517000 LB 0x8000 (base 00007ffdbf420000) - 'atcuf64.dll'
  202. 27c8.36b8: 00007ffdbf51f000-00007ffdbf524fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  203. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf51f000 LB 0x6000 (base 00007ffdbf420000) - 'atcuf64.dll'
  204. 27c8.36b8: 00007ffdbf525000-00007ffdbf531fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\atcuf\dlls_265691267052696454\atcuf64.dll
  205. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf525000 LB 0xd000 (base 00007ffdbf420000) - 'atcuf64.dll'
  206. 27c8.36b8: 00007ffdbf532000-00007ffdbf53ffff 0x0001/0x0000 0x0000000
  207. 27c8.36b8: *00007ffdbf540000-00007ffdbf540fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdhkm\dlls_265691267062722177\bdhkm64.dll
  208. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf540000 LB 0x1000 (base 00007ffdbf540000) - 'bdhkm64.dll'
  209. 27c8.36b8: 00007ffdbf541000-00007ffdbf56ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdhkm\dlls_265691267062722177\bdhkm64.dll
  210. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf541000 LB 0x2f000 (base 00007ffdbf540000) - 'bdhkm64.dll'
  211. 27c8.36b8: 00007ffdbf570000-00007ffdbf5fffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdhkm\dlls_265691267062722177\bdhkm64.dll
  212. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf570000 LB 0x90000 (base 00007ffdbf540000) - 'bdhkm64.dll'
  213. 27c8.36b8: 00007ffdbf600000-00007ffdbf600fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdhkm\dlls_265691267062722177\bdhkm64.dll
  214. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf600000 LB 0x1000 (base 00007ffdbf540000) - 'bdhkm64.dll'
  215. 27c8.36b8: 00007ffdbf601000-00007ffdbf608fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdhkm\dlls_265691267062722177\bdhkm64.dll
  216. 27c8.36b8: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 00007ffdbf601000 LB 0x8000 (base 00007ffdbf540000) - 'bdhkm64.dll'
  217. 27c8.36b8: 00007ffdbf609000-00007ffdf3fdffff 0x0001/0x0000 0x0000000
  218. 27c8.36b8: *00007ffdf3fe0000-00007ffdf3fe0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  219. 27c8.36b8: 00007ffdf3fe1000-00007ffdf40f1fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  220. 27c8.36b8: 00007ffdf40f2000-00007ffdf4269fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  221. 27c8.36b8: 00007ffdf426a000-00007ffdf426dfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  222. 27c8.36b8: 00007ffdf426e000-00007ffdf426efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  223. 27c8.36b8: 00007ffdf426f000-00007ffdf42a7fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  224. 27c8.36b8: 00007ffdf42a8000-00007ffdf63effff 0x0001/0x0000 0x0000000
  225. 27c8.36b8: *00007ffdf63f0000-00007ffdf63f0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  226. 27c8.36b8: 00007ffdf63f1000-00007ffdf646ffff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  227. 27c8.36b8: 00007ffdf6470000-00007ffdf64a2fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  228. 27c8.36b8: 00007ffdf64a3000-00007ffdf64a3fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  229. 27c8.36b8: 00007ffdf64a4000-00007ffdf64a4fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  230. 27c8.36b8: 00007ffdf64a5000-00007ffdf64adfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  231. 27c8.36b8: 00007ffdf64ae000-00007ffdf676ffff 0x0001/0x0000 0x0000000
  232. 27c8.36b8: *00007ffdf6770000-00007ffdf6770fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  233. 27c8.36b8: 00007ffdf6771000-00007ffdf688bfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  234. 27c8.36b8: 00007ffdf688c000-00007ffdf68d3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  235. 27c8.36b8: 00007ffdf68d4000-00007ffdf68d4fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  236. 27c8.36b8: 00007ffdf68d5000-00007ffdf68d6fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  237. 27c8.36b8: 00007ffdf68d7000-00007ffdf68dffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  238. 27c8.36b8: 00007ffdf68e0000-00007ffdf6964fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  239. 27c8.36b8: 00007ffdf6965000-00007ffdf696ffff 0x0001/0x0000 0x0000000
  240. 27c8.36b8: *00007ffdf6970000-00007ffdf6970fff 0x0020/0x0002 0x0020000 !!
  241. 27c8.36b8: 00007ffdf6971000-00007ffdf697ffff 0x0002/0x0002 0x0020000
  242. 27c8.36b8: *00007ffdf6980000-00007ffdf6980fff 0x0020/0x0002 0x0020000 !!
  243. 27c8.36b8: 00007ffdf6981000-00007ffdf698ffff 0x0002/0x0002 0x0020000
  244. 27c8.36b8: 00007ffdf6990000-00007ffffffeffff 0x0001/0x0000 0x0000000
  245. 27c8.36b8: kernel32.dll: timestamp 0x38b369c4 (rc=VINF_SUCCESS)
  246. 27c8.36b8: kernelbase.dll: timestamp 0xb9a844a (rc=VINF_SUCCESS)
  247. 27c8.36b8: VirtualBoxVM.exe: timestamp 0x619bb44c (rc=VINF_SUCCESS)
  248. 27c8.36b8: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  249. 27c8.36b8: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  250. 27c8.36b8: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  251. 27c8.36b8: ntdll.dll: Differences in section #1 (.text) between file and memory:
  252. 27c8.36b8: 00007ffdf67a2ad0 / 0x0032ad0: 4c != e9
  253. 27c8.36b8: 00007ffdf67a2ad1 / 0x0032ad1: 89 != 5e
  254. 27c8.36b8: 00007ffdf67a2ad2 / 0x0032ad2: 4c != d5
  255. 27c8.36b8: 00007ffdf67a2ad3 / 0x0032ad3: 24 != 1c
  256. 27c8.36b8: 00007ffdf67a2ad4 / 0x0032ad4: 20 != 00
  257. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf67a1000
  258. 27c8.36b8: ntdll.dll: Differences in section #1 (.text) between file and memory:
  259. 27c8.36b8: 00007ffdf680ce60 / 0x009ce60: 4c != e9
  260. 27c8.36b8: 00007ffdf680ce61 / 0x009ce61: 8b != f4
  261. 27c8.36b8: 00007ffdf680ce62 / 0x009ce62: d1 != 3e
  262. 27c8.36b8: 00007ffdf680ce63 / 0x009ce63: b8 != 16
  263. 27c8.36b8: 00007ffdf680ce64 / 0x009ce64: 08 != 00
  264. 27c8.36b8: 00007ffdf680ce65 / 0x009ce65: 00 != cc
  265. 27c8.36b8: 00007ffdf680ce66 / 0x009ce66: 00 != cc
  266. 27c8.36b8: 00007ffdf680ce67 / 0x009ce67: 00 != cc
  267. 27c8.36b8: 00007ffdf680cf00 / 0x009cf00: 4c != e9
  268. 27c8.36b8: 00007ffdf680cf02 / 0x009cf02: d1 != 3a
  269. 27c8.36b8: 00007ffdf680cf03 / 0x009cf03: b8 != 16
  270. 27c8.36b8: 00007ffdf680cf04 / 0x009cf04: 0d != 00
  271. 27c8.36b8: 00007ffdf680cf05 / 0x009cf05: 00 != cc
  272. 27c8.36b8: 00007ffdf680cf06 / 0x009cf06: 00 != cc
  273. 27c8.36b8: 00007ffdf680cf07 / 0x009cf07: 00 != cc
  274. 27c8.36b8: 00007ffdf680cf40 / 0x009cf40: 4c != e9
  275. 27c8.36b8: 00007ffdf680cf41 / 0x009cf41: 8b != 85
  276. 27c8.36b8: 00007ffdf680cf42 / 0x009cf42: d1 != 33
  277. 27c8.36b8: 00007ffdf680cf43 / 0x009cf43: b8 != 16
  278. 27c8.36b8: 00007ffdf680cf44 / 0x009cf44: 0f != 00
  279. 27c8.36b8: 00007ffdf680cf45 / 0x009cf45: 00 != cc
  280. 27c8.36b8: 00007ffdf680cf46 / 0x009cf46: 00 != cc
  281. 27c8.36b8: 00007ffdf680cf47 / 0x009cf47: 00 != cc
  282. 27c8.36b8: 00007ffdf680d080 / 0x009d080: 4c != e9
  283. 27c8.36b8: 00007ffdf680d081 / 0x009d081: 8b != 3b
  284. 27c8.36b8: 00007ffdf680d082 / 0x009d082: d1 != 3c
  285. 27c8.36b8: 00007ffdf680d083 / 0x009d083: b8 != 16
  286. 27c8.36b8: 00007ffdf680d084 / 0x009d084: 19 != 00
  287. 27c8.36b8: 00007ffdf680d085 / 0x009d085: 00 != cc
  288. 27c8.36b8: 00007ffdf680d086 / 0x009d086: 00 != cc
  289. 27c8.36b8: 00007ffdf680d087 / 0x009d087: 00 != cc
  290. 27c8.36b8: 00007ffdf680d220 / 0x009d220: 4c != e9
  291. 27c8.36b8: 00007ffdf680d221 / 0x009d221: 8b != d6
  292. 27c8.36b8: 00007ffdf680d222 / 0x009d222: d1 != 32
  293. 27c8.36b8: 00007ffdf680d223 / 0x009d223: b8 != 16
  294. 27c8.36b8: 00007ffdf680d224 / 0x009d224: 26 != 00
  295. 27c8.36b8: 00007ffdf680d225 / 0x009d225: 00 != cc
  296. 27c8.36b8: 00007ffdf680d226 / 0x009d226: 00 != cc
  297. 27c8.36b8: 00007ffdf680d227 / 0x009d227: 00 != cc
  298. 27c8.36b8: 00007ffdf680d260 / 0x009d260: 4c != e9
  299. 27c8.36b8: 00007ffdf680d261 / 0x009d261: 8b != fb
  300. 27c8.36b8: 00007ffdf680d262 / 0x009d262: d1 != 33
  301. 27c8.36b8: 00007ffdf680d263 / 0x009d263: b8 != 16
  302. 27c8.36b8: 00007ffdf680d264 / 0x009d264: 28 != 00
  303. 27c8.36b8: 00007ffdf680d265 / 0x009d265: 00 != cc
  304. 27c8.36b8: 00007ffdf680d266 / 0x009d266: 00 != cc
  305. 27c8.36b8: 00007ffdf680d267 / 0x009d267: 00 != cc
  306. 27c8.36b8: 00007ffdf680d2a0 / 0x009d2a0: 4c != e9
  307. 27c8.36b8: 00007ffdf680d2a1 / 0x009d2a1: 8b != 1d
  308. 27c8.36b8: 00007ffdf680d2a2 / 0x009d2a2: d1 != 38
  309. 27c8.36b8: 00007ffdf680d2a3 / 0x009d2a3: b8 != 16
  310. 27c8.36b8: 00007ffdf680d2a4 / 0x009d2a4: 2a != 00
  311. 27c8.36b8: 00007ffdf680d2a5 / 0x009d2a5: 00 != cc
  312. 27c8.36b8: 00007ffdf680d2a6 / 0x009d2a6: 00 != cc
  313. 27c8.36b8: 00007ffdf680d2a7 / 0x009d2a7: 00 != cc
  314. 27c8.36b8: 00007ffdf680d2e0 / 0x009d2e0: 4c != e9
  315. 27c8.36b8: 00007ffdf680d2e1 / 0x009d2e1: 8b != 1b
  316. 27c8.36b8: 00007ffdf680d2e2 / 0x009d2e2: d1 != 2d
  317. 27c8.36b8: 00007ffdf680d2e3 / 0x009d2e3: b8 != 16
  318. 27c8.36b8: 00007ffdf680d2e4 / 0x009d2e4: 2c != 00
  319. 27c8.36b8: 00007ffdf680d2e5 / 0x009d2e5: 00 != cc
  320. 27c8.36b8: 00007ffdf680d2e6 / 0x009d2e6: 00 != cc
  321. 27c8.36b8: 00007ffdf680d2e7 / 0x009d2e7: 00 != cc
  322. 27c8.36b8: 00007ffdf680d4a0 / 0x009d4a0: 4c != e9
  323. 27c8.36b8: 00007ffdf680d4a1 / 0x009d4a1: 8b != bd
  324. 27c8.36b8: 00007ffdf680d4a2 / 0x009d4a2: d1 != 2f
  325. 27c8.36b8: 00007ffdf680d4a3 / 0x009d4a3: b8 != 16
  326. 27c8.36b8: 00007ffdf680d4a4 / 0x009d4a4: 3a != 00
  327. 27c8.36b8: 00007ffdf680d4a5 / 0x009d4a5: 00 != cc
  328. 27c8.36b8: 00007ffdf680d4a6 / 0x009d4a6: 00 != cc
  329. 27c8.36b8: 00007ffdf680d4a7 / 0x009d4a7: 00 != cc
  330. 27c8.36b8: 00007ffdf680d4e0 / 0x009d4e0: 4c != e9
  331. 27c8.36b8: 00007ffdf680d4e1 / 0x009d4e1: 8b != 7c
  332. 27c8.36b8: 00007ffdf680d4e2 / 0x009d4e2: d1 != 30
  333. 27c8.36b8: 00007ffdf680d4e3 / 0x009d4e3: b8 != 16
  334. 27c8.36b8: 00007ffdf680d4e4 / 0x009d4e4: 3c != 00
  335. 27c8.36b8: 00007ffdf680d4e5 / 0x009d4e5: 00 != cc
  336. 27c8.36b8: 00007ffdf680d4e6 / 0x009d4e6: 00 != cc
  337. 27c8.36b8: 00007ffdf680d4e7 / 0x009d4e7: 00 != cc
  338. 27c8.36b8: 00007ffdf680d540 / 0x009d540: 4c != e9
  339. 27c8.36b8: 00007ffdf680d541 / 0x009d541: 8b != ac
  340. 27c8.36b8: 00007ffdf680d542 / 0x009d542: d1 != 39
  341. 27c8.36b8: 00007ffdf680d543 / 0x009d543: b8 != 16
  342. 27c8.36b8: 00007ffdf680d544 / 0x009d544: 3f != 00
  343. 27c8.36b8: 00007ffdf680d545 / 0x009d545: 00 != cc
  344. 27c8.36b8: 00007ffdf680d546 / 0x009d546: 00 != cc
  345. 27c8.36b8: 00007ffdf680d547 / 0x009d547: 00 != cc
  346. 27c8.36b8: 00007ffdf680d580 / 0x009d580: 4c != e9
  347. 27c8.36b8: 00007ffdf680d581 / 0x009d581: 8b != e1
  348. 27c8.36b8: 00007ffdf680d582 / 0x009d582: d1 != 2a
  349. 27c8.36b8: 00007ffdf680d583 / 0x009d583: b8 != 16
  350. 27c8.36b8: 00007ffdf680d584 / 0x009d584: 41 != 00
  351. 27c8.36b8: 00007ffdf680d585 / 0x009d585: 00 != cc
  352. 27c8.36b8: 00007ffdf680d586 / 0x009d586: 00 != cc
  353. 27c8.36b8: 00007ffdf680d587 / 0x009d587: 00 != cc
  354. 27c8.36b8: 00007ffdf680d600 / 0x009d600: 4c != e9
  355. 27c8.36b8: 00007ffdf680d601 / 0x009d601: 8b != c2
  356. 27c8.36b8: 00007ffdf680d602 / 0x009d602: d1 != 2f
  357. 27c8.36b8: 00007ffdf680d603 / 0x009d603: b8 != 16
  358. 27c8.36b8: 00007ffdf680d604 / 0x009d604: 45 != 00
  359. 27c8.36b8: 00007ffdf680d605 / 0x009d605: 00 != cc
  360. 27c8.36b8: 00007ffdf680d606 / 0x009d606: 00 != cc
  361. 27c8.36b8: 00007ffdf680d607 / 0x009d607: 00 != cc
  362. 27c8.36b8: 00007ffdf680d6a0 / 0x009d6a0: 4c != e9
  363. 27c8.36b8: 00007ffdf680d6a1 / 0x009d6a1: 8b != e7
  364. 27c8.36b8: 00007ffdf680d6a2 / 0x009d6a2: d1 != 36
  365. 27c8.36b8: 00007ffdf680d6a3 / 0x009d6a3: b8 != 16
  366. 27c8.36b8: 00007ffdf680d6a4 / 0x009d6a4: 4a != 00
  367. 27c8.36b8: 00007ffdf680d6a5 / 0x009d6a5: 00 != cc
  368. 27c8.36b8: 00007ffdf680d6a6 / 0x009d6a6: 00 != cc
  369. 27c8.36b8: 00007ffdf680d6a7 / 0x009d6a7: 00 != cc
  370. 27c8.36b8: 00007ffdf680d700 / 0x009d700: 4c != e9
  371. 27c8.36b8: 00007ffdf680d701 / 0x009d701: 8b != 2b
  372. 27c8.36b8: 00007ffdf680d702 / 0x009d702: d1 != 2c
  373. 27c8.36b8: 00007ffdf680d703 / 0x009d703: b8 != 16
  374. 27c8.36b8: 00007ffdf680d704 / 0x009d704: 4d != 00
  375. 27c8.36b8: 00007ffdf680d705 / 0x009d705: 00 != cc
  376. 27c8.36b8: 00007ffdf680d706 / 0x009d706: 00 != cc
  377. 27c8.36b8: 00007ffdf680d707 / 0x009d707: 00 != cc
  378. 27c8.36b8: 00007ffdf680d720 / 0x009d720: 4c != e9
  379. 27c8.36b8: 00007ffdf680d721 / 0x009d721: 8b != d7
  380. 27c8.36b8: 00007ffdf680d722 / 0x009d722: d1 != 2c
  381. 27c8.36b8: 00007ffdf680d723 / 0x009d723: b8 != 16
  382. 27c8.36b8: 00007ffdf680d724 / 0x009d724: 4e != 00
  383. 27c8.36b8: 00007ffdf680d725 / 0x009d725: 00 != cc
  384. 27c8.36b8: 00007ffdf680d726 / 0x009d726: 00 != cc
  385. 27c8.36b8: 00007ffdf680d727 / 0x009d727: 00 != cc
  386. 27c8.36b8: 00007ffdf680d7a0 / 0x009d7a0: 4c != e9
  387. 27c8.36b8: 00007ffdf680d7a1 / 0x009d7a1: 8b != 83
  388. 27c8.36b8: 00007ffdf680d7a2 / 0x009d7a2: d1 != 33
  389. 27c8.36b8: 00007ffdf680d7a3 / 0x009d7a3: b8 != 16
  390. 27c8.36b8: 00007ffdf680d7a4 / 0x009d7a4: 52 != 00
  391. 27c8.36b8: 00007ffdf680d7a5 / 0x009d7a5: 00 != cc
  392. 27c8.36b8: 00007ffdf680d7a6 / 0x009d7a6: 00 != cc
  393. 27c8.36b8: 00007ffdf680d7a7 / 0x009d7a7: 00 != cc
  394. 27c8.36b8: 00007ffdf680dc70 / 0x009dc70: 4c != e9
  395. 27c8.36b8: 00007ffdf680dc71 / 0x009dc71: 8b != 4e
  396. 27c8.36b8: 00007ffdf680dc72 / 0x009dc72: d1 != 2d
  397. 27c8.36b8: 00007ffdf680dc73 / 0x009dc73: b8 != 16
  398. 27c8.36b8: 00007ffdf680dc74 / 0x009dc74: 79 != 00
  399. 27c8.36b8: 00007ffdf680dc75 / 0x009dc75: 00 != cc
  400. 27c8.36b8: 00007ffdf680dc76 / 0x009dc76: 00 != cc
  401. 27c8.36b8: 00007ffdf680dc77 / 0x009dc77: 00 != cc
  402. 27c8.36b8: 00007ffdf680dcb0 / 0x009dcb0: 4c != e9
  403. 27c8.36b8: 00007ffdf680dcb1 / 0x009dcb1: 8b != 41
  404. 27c8.36b8: 00007ffdf680dcb2 / 0x009dcb2: d1 != 2d
  405. 27c8.36b8: 00007ffdf680dcb3 / 0x009dcb3: b8 != 16
  406. 27c8.36b8: 00007ffdf680dcb4 / 0x009dcb4: 7b != 00
  407. 27c8.36b8: 00007ffdf680dcb5 / 0x009dcb5: 00 != cc
  408. 27c8.36b8: 00007ffdf680dcb6 / 0x009dcb6: 00 != cc
  409. 27c8.36b8: 00007ffdf680dcb7 / 0x009dcb7: 00 != cc
  410. 27c8.36b8: 00007ffdf680ded0 / 0x009ded0: 4c != e9
  411. 27c8.36b8: 00007ffdf680ded1 / 0x009ded1: 8b != 54
  412. 27c8.36b8: 00007ffdf680ded2 / 0x009ded2: d1 != 2b
  413. 27c8.36b8: 00007ffdf680ded3 / 0x009ded3: b8 != 16
  414. 27c8.36b8: 00007ffdf680ded4 / 0x009ded4: 8c != 00
  415. 27c8.36b8: 00007ffdf680ded5 / 0x009ded5: 00 != cc
  416. 27c8.36b8: 00007ffdf680ded6 / 0x009ded6: 00 != cc
  417. 27c8.36b8: 00007ffdf680ded7 / 0x009ded7: 00 != cc
  418. 27c8.36b8: 00007ffdf680e070 / 0x009e070: 4c != e9
  419. 27c8.36b8: 00007ffdf680e071 / 0x009e071: 8b != b0
  420. 27c8.36b8: 00007ffdf680e072 / 0x009e072: d1 != 2d
  421. 27c8.36b8: 00007ffdf680e073 / 0x009e073: b8 != 16
  422. 27c8.36b8: 00007ffdf680e074 / 0x009e074: 99 != 00
  423. 27c8.36b8: 00007ffdf680e075 / 0x009e075: 00 != cc
  424. 27c8.36b8: 00007ffdf680e076 / 0x009e076: 00 != cc
  425. 27c8.36b8: 00007ffdf680e077 / 0x009e077: 00 != cc
  426. 27c8.36b8: 00007ffdf680e3b0 / 0x009e3b0: 4c != e9
  427. 27c8.36b8: 00007ffdf680e3b1 / 0x009e3b1: 8b != d6
  428. 27c8.36b8: 00007ffdf680e3b2 / 0x009e3b2: d1 != 2a
  429. 27c8.36b8: 00007ffdf680e3b3 / 0x009e3b3: b8 != 16
  430. 27c8.36b8: 00007ffdf680e3b4 / 0x009e3b4: b3 != 00
  431. 27c8.36b8: 00007ffdf680e3b5 / 0x009e3b5: 00 != cc
  432. 27c8.36b8: 00007ffdf680e3b6 / 0x009e3b6: 00 != cc
  433. 27c8.36b8: 00007ffdf680e3b7 / 0x009e3b7: 00 != cc
  434. 27c8.36b8: 00007ffdf680e470 / 0x009e470: 4c != e9
  435. 27c8.36b8: 00007ffdf680e471 / 0x009e471: 8b != 88
  436. 27c8.36b8: 00007ffdf680e472 / 0x009e472: d1 != 1e
  437. 27c8.36b8: 00007ffdf680e473 / 0x009e473: b8 != 16
  438. 27c8.36b8: 00007ffdf680e474 / 0x009e474: b9 != 00
  439. 27c8.36b8: 00007ffdf680e475 / 0x009e475: 00 != cc
  440. 27c8.36b8: 00007ffdf680e476 / 0x009e476: 00 != cc
  441. 27c8.36b8: 00007ffdf680e477 / 0x009e477: 00 != cc
  442. 27c8.36b8: 00007ffdf680e510 / 0x009e510: 4c != e9
  443. 27c8.36b8: 00007ffdf680e511 / 0x009e511: 8b != aa
  444. 27c8.36b8: 00007ffdf680e512 / 0x009e512: d1 != 28
  445. 27c8.36b8: 00007ffdf680e513 / 0x009e513: b8 != 16
  446. 27c8.36b8: 00007ffdf680e514 / 0x009e514: be != 00
  447. 27c8.36b8: 00007ffdf680e515 / 0x009e515: 00 != cc
  448. 27c8.36b8: 00007ffdf680e516 / 0x009e516: 00 != cc
  449. 27c8.36b8: 00007ffdf680e517 / 0x009e517: 00 != cc
  450. 27c8.36b8: 00007ffdf680e550 / 0x009e550: 4c != e9
  451. 27c8.36b8: 00007ffdf680e551 / 0x009e551: 8b != cf
  452. 27c8.36b8: 00007ffdf680e552 / 0x009e552: d1 != 29
  453. 27c8.36b8: 00007ffdf680e553 / 0x009e553: b8 != 16
  454. 27c8.36b8: 00007ffdf680e554 / 0x009e554: c0 != 00
  455. 27c8.36b8: 00007ffdf680e555 / 0x009e555: 00 != cc
  456. 27c8.36b8: 00007ffdf680e556 / 0x009e556: 00 != cc
  457. 27c8.36b8: 00007ffdf680e557 / 0x009e557: 00 != cc
  458. 27c8.36b8: 00007ffdf680e570 / 0x009e570: 4c != e9
  459. 27c8.36b8: 00007ffdf680e571 / 0x009e571: 8b != ba
  460. 27c8.36b8: 00007ffdf680e572 / 0x009e572: d1 != 1e
  461. 27c8.36b8: 00007ffdf680e573 / 0x009e573: b8 != 16
  462. 27c8.36b8: 00007ffdf680e574 / 0x009e574: c1 != 00
  463. 27c8.36b8: 00007ffdf680e575 / 0x009e575: 00 != cc
  464. 27c8.36b8: 00007ffdf680e576 / 0x009e576: 00 != cc
  465. 27c8.36b8: 00007ffdf680e577 / 0x009e577: 00 != cc
  466. 27c8.36b8: 00007ffdf680e610 / 0x009e610: 4c != e9
  467. 27c8.36b8: 00007ffdf680e611 / 0x009e611: 8b != de
  468. 27c8.36b8: 00007ffdf680e612 / 0x009e612: d1 != 26
  469. 27c8.36b8: 00007ffdf680e613 / 0x009e613: b8 != 16
  470. 27c8.36b8: 00007ffdf680e614 / 0x009e614: c6 != 00
  471. 27c8.36b8: 00007ffdf680e615 / 0x009e615: 00 != cc
  472. 27c8.36b8: 00007ffdf680e616 / 0x009e616: 00 != cc
  473. 27c8.36b8: 00007ffdf680e617 / 0x009e617: 00 != cc
  474. 27c8.36b8: 00007ffdf680e650 / 0x009e650: 4c != e9
  475. 27c8.36b8: 00007ffdf680e651 / 0x009e651: 8b != 0e
  476. 27c8.36b8: 00007ffdf680e652 / 0x009e652: d1 != 1d
  477. 27c8.36b8: 00007ffdf680e653 / 0x009e653: b8 != 16
  478. 27c8.36b8: 00007ffdf680e654 / 0x009e654: c8 != 00
  479. 27c8.36b8: 00007ffdf680e655 / 0x009e655: 00 != cc
  480. 27c8.36b8: 00007ffdf680e656 / 0x009e656: 00 != cc
  481. 27c8.36b8: 00007ffdf680e657 / 0x009e657: 00 != cc
  482. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf680cb0e
  483. 27c8.36b8: ntdll.dll: Differences in section #1 (.text) between file and memory:
  484. 27c8.36b8: 00007ffdf680edf0 / 0x009edf0: 4c != e9
  485. 27c8.36b8: 00007ffdf680edf1 / 0x009edf1: 8b != c9
  486. 27c8.36b8: 00007ffdf680edf2 / 0x009edf2: d1 != 20
  487. 27c8.36b8: 00007ffdf680edf3 / 0x009edf3: b8 != 16
  488. 27c8.36b8: 00007ffdf680edf4 / 0x009edf4: 05 != 00
  489. 27c8.36b8: 00007ffdf680edf5 / 0x009edf5: 01 != cc
  490. 27c8.36b8: 00007ffdf680edf6 / 0x009edf6: 00 != cc
  491. 27c8.36b8: 00007ffdf680edf7 / 0x009edf7: 00 != cc
  492. 27c8.36b8: 00007ffdf680f950 / 0x009f950: 4c != e9
  493. 27c8.36b8: 00007ffdf680f951 / 0x009f951: 8b != 3a
  494. 27c8.36b8: 00007ffdf680f952 / 0x009f952: d1 != 11
  495. 27c8.36b8: 00007ffdf680f953 / 0x009f953: b8 != 16
  496. 27c8.36b8: 00007ffdf680f954 / 0x009f954: 60 != 00
  497. 27c8.36b8: 00007ffdf680f955 / 0x009f955: 01 != cc
  498. 27c8.36b8: 00007ffdf680f956 / 0x009f956: 00 != cc
  499. 27c8.36b8: 00007ffdf680f957 / 0x009f957: 00 != cc
  500. 27c8.36b8: 00007ffdf680fa30 / 0x009fa30: 4c != e9
  501. 27c8.36b8: 00007ffdf680fa31 / 0x009fa31: 8b != 96
  502. 27c8.36b8: 00007ffdf680fa32 / 0x009fa32: d1 != 07
  503. 27c8.36b8: 00007ffdf680fa33 / 0x009fa33: b8 != 16
  504. 27c8.36b8: 00007ffdf680fa34 / 0x009fa34: 67 != 00
  505. 27c8.36b8: 00007ffdf680fa35 / 0x009fa35: 01 != cc
  506. 27c8.36b8: 00007ffdf680fa36 / 0x009fa36: 00 != cc
  507. 27c8.36b8: 00007ffdf680fa37 / 0x009fa37: 00 != cc
  508. 27c8.36b8: 00007ffdf680fd50 / 0x009fd50: 4c != e9
  509. 27c8.36b8: 00007ffdf680fd51 / 0x009fd51: 8b != 9d
  510. 27c8.36b8: 00007ffdf680fd52 / 0x009fd52: d1 != 10
  511. 27c8.36b8: 00007ffdf680fd53 / 0x009fd53: b8 != 16
  512. 27c8.36b8: 00007ffdf680fd54 / 0x009fd54: 80 != 00
  513. 27c8.36b8: 00007ffdf680fd55 / 0x009fd55: 01 != cc
  514. 27c8.36b8: 00007ffdf680fd56 / 0x009fd56: 00 != cc
  515. 27c8.36b8: 00007ffdf680fd57 / 0x009fd57: 00 != cc
  516. 27c8.36b8: 00007ffdf680feb0 / 0x009feb0: 4c != e9
  517. 27c8.36b8: 00007ffdf680feb1 / 0x009feb1: 8b != 45
  518. 27c8.36b8: 00007ffdf680feb2 / 0x009feb2: d1 != 07
  519. 27c8.36b8: 00007ffdf680feb3 / 0x009feb3: b8 != 16
  520. 27c8.36b8: 00007ffdf680feb4 / 0x009feb4: 8b != 00
  521. 27c8.36b8: 00007ffdf680feb5 / 0x009feb5: 01 != cc
  522. 27c8.36b8: 00007ffdf680feb6 / 0x009feb6: 00 != cc
  523. 27c8.36b8: 00007ffdf680feb7 / 0x009feb7: 00 != cc
  524. 27c8.36b8: 00007ffdf68100d0 / 0x00a00d0: 4c != e9
  525. 27c8.36b8: 00007ffdf68100d1 / 0x00a00d1: 8b != 83
  526. 27c8.36b8: 00007ffdf68100d2 / 0x00a00d2: d1 != 0d
  527. 27c8.36b8: 00007ffdf68100d3 / 0x00a00d3: b8 != 16
  528. 27c8.36b8: 00007ffdf68100d4 / 0x00a00d4: 9c != 00
  529. 27c8.36b8: 00007ffdf68100d5 / 0x00a00d5: 01 != cc
  530. 27c8.36b8: 00007ffdf68100d6 / 0x00a00d6: 00 != cc
  531. 27c8.36b8: 00007ffdf68100d7 / 0x00a00d7: 00 != cc
  532. 27c8.36b8: 00007ffdf6810270 / 0x00a0270: 4c != e9
  533. 27c8.36b8: 00007ffdf6810271 / 0x00a0271: 8b != e7
  534. 27c8.36b8: 00007ffdf6810272 / 0x00a0272: d1 != 07
  535. 27c8.36b8: 00007ffdf6810273 / 0x00a0273: b8 != 16
  536. 27c8.36b8: 00007ffdf6810274 / 0x00a0274: a9 != 00
  537. 27c8.36b8: 00007ffdf6810275 / 0x00a0275: 01 != cc
  538. 27c8.36b8: 00007ffdf6810276 / 0x00a0276: 00 != cc
  539. 27c8.36b8: 00007ffdf6810277 / 0x00a0277: 00 != cc
  540. 27c8.36b8: Restored 0x1f62 bytes of original file content at 00007ffdf680eb0e
  541. 27c8.36b8: ntdll.dll: Differences in section #1 (.text) between file and memory:
  542. 27c8.36b8: 00007ffdf684c140 / 0x00dc140: 4c != e9
  543. 27c8.36b8: 00007ffdf684c141 / 0x00dc141: 8b != b0
  544. 27c8.36b8: 00007ffdf684c142 / 0x00dc142: c2 != 49
  545. 27c8.36b8: 00007ffdf684c143 / 0x00dc143: 41 != 12
  546. 27c8.36b8: 00007ffdf684c144 / 0x00dc144: b9 != 00
  547. 27c8.36b8: 00007ffdf684c146 / 0x00dc146: 02 != cc
  548. 27c8.36b8: 00007ffdf684c147 / 0x00dc147: 00 != cc
  549. 27c8.36b8: 00007ffdf684c148 / 0x00dc148: 00 != cc
  550. 27c8.36b8: 00007ffdf684c890 / 0x00dc890: 48 != e9
  551. 27c8.36b8: 00007ffdf684c891 / 0x00dc891: 8b != 69
  552. 27c8.36b8: 00007ffdf684c892 / 0x00dc892: c4 != 39
  553. 27c8.36b8: 00007ffdf684c893 / 0x00dc893: 48 != 12
  554. 27c8.36b8: 00007ffdf684c894 / 0x00dc894: 89 != 00
  555. 27c8.36b8: 00007ffdf684c895 / 0x00dc895: 58 != cc
  556. 27c8.36b8: 00007ffdf684c896 / 0x00dc896: 08 != cc
  557. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf684abde
  558. 27c8.36b8: kernel32.dll: Differences in section #1 (.text) between file and memory:
  559. 27c8.36b8: 00007ffdf6412430 / 0x0022430: 4c != e9
  560. 27c8.36b8: 00007ffdf6412431 / 0x0022431: 8b != 62
  561. 27c8.36b8: 00007ffdf6412432 / 0x0022432: dc != de
  562. 27c8.36b8: 00007ffdf6412433 / 0x0022433: 53 != 55
  563. 27c8.36b8: 00007ffdf6412434 / 0x0022434: 56 != 00
  564. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf6411000
  565. 27c8.36b8: kernel32.dll: Differences in section #1 (.text) between file and memory:
  566. 27c8.36b8: 00007ffdf6417420 / 0x0027420: 89 != e9
  567. 27c8.36b8: 00007ffdf6417421 / 0x0027421: 54 != 08
  568. 27c8.36b8: 00007ffdf6417422 / 0x0027422: 24 != 92
  569. 27c8.36b8: 00007ffdf6417423 / 0x0027423: 10 != 55
  570. 27c8.36b8: 00007ffdf6417424 / 0x0027424: 89 != 00
  571. 27c8.36b8: 00007ffdf6417425 / 0x0027425: 4c != cc
  572. 27c8.36b8: 00007ffdf6417426 / 0x0027426: 24 != cc
  573. 27c8.36b8: 00007ffdf6417427 / 0x0027427: 08 != cc
  574. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf6417000
  575. 27c8.36b8: kernel32.dll: Differences in section #1 (.text) between file and memory:
  576. 27c8.36b8: 00007ffdf64523d0 / 0x00623d0: 48 != e9
  577. 27c8.36b8: 00007ffdf64523d1 / 0x00623d1: 8b != 51
  578. 27c8.36b8: 00007ffdf64523d2 / 0x00623d2: c4 != e9
  579. 27c8.36b8: 00007ffdf64523d3 / 0x00623d3: 48 != 51
  580. 27c8.36b8: 00007ffdf64523d4 / 0x00623d4: 89 != 00
  581. 27c8.36b8: 00007ffdf64523d5 / 0x00623d5: 58 != cc
  582. 27c8.36b8: 00007ffdf64523d6 / 0x00623d6: 08 != cc
  583. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf6451000
  584. 27c8.36b8: kernel32.dll: Differences in section #1 (.text) between file and memory:
  585. 27c8.36b8: 00007ffdf6453a80 / 0x0063a80: 48 != e9
  586. 27c8.36b8: 00007ffdf6453a81 / 0x0063a81: 83 != a7
  587. 27c8.36b8: 00007ffdf6453a82 / 0x0063a82: ec != cc
  588. 27c8.36b8: 00007ffdf6453a83 / 0x0063a83: 38 != 51
  589. 27c8.36b8: 00007ffdf6453a84 / 0x0063a84: 48 != 00
  590. 27c8.36b8: 00007ffdf6453a85 / 0x0063a85: 83 != cc
  591. 27c8.36b8: 00007ffdf6453a86 / 0x0063a86: 64 != cc
  592. 27c8.36b8: 00007ffdf6453a87 / 0x0063a87: 24 != cc
  593. 27c8.36b8: 00007ffdf6453a88 / 0x0063a88: 28 != cc
  594. 27c8.36b8: 00007ffdf6453a89 / 0x0063a89: 00 != cc
  595. 27c8.36b8: 00007ffdf6453b90 / 0x0063b90: 48 != e9
  596. 27c8.36b8: 00007ffdf6453b91 / 0x0063b91: 83 != fd
  597. 27c8.36b8: 00007ffdf6453b92 / 0x0063b92: ec != cb
  598. 27c8.36b8: 00007ffdf6453b93 / 0x0063b93: 38 != 51
  599. 27c8.36b8: 00007ffdf6453b94 / 0x0063b94: 48 != 00
  600. 27c8.36b8: 00007ffdf6453b95 / 0x0063b95: 83 != cc
  601. 27c8.36b8: 00007ffdf6453b96 / 0x0063b96: 64 != cc
  602. 27c8.36b8: 00007ffdf6453b97 / 0x0063b97: 24 != cc
  603. 27c8.36b8: 00007ffdf6453b98 / 0x0063b98: 28 != cc
  604. 27c8.36b8: 00007ffdf6453b99 / 0x0063b99: 00 != cc
  605. 27c8.36b8: 00007ffdf6454e50 / 0x0064e50: 48 != e9
  606. 27c8.36b8: 00007ffdf6454e51 / 0x0064e51: 89 != 71
  607. 27c8.36b8: 00007ffdf6454e52 / 0x0064e52: 5c != b8
  608. 27c8.36b8: 00007ffdf6454e53 / 0x0064e53: 24 != 51
  609. 27c8.36b8: 00007ffdf6454e54 / 0x0064e54: 08 != 00
  610. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf6453000
  611. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  612. 27c8.36b8: 00007ffdf3fe3cb0 / 0x0003cb0: 40 != e9
  613. 27c8.36b8: 00007ffdf3fe3cb1 / 0x0003cb1: 55 != 44
  614. 27c8.36b8: 00007ffdf3fe3cb2 / 0x0003cb2: 53 != ca
  615. 27c8.36b8: 00007ffdf3fe3cb3 / 0x0003cb3: 56 != 98
  616. 27c8.36b8: 00007ffdf3fe3cb4 / 0x0003cb4: 57 != 02
  617. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf3fe3000
  618. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  619. 27c8.36b8: 00007ffdf3fe7140 / 0x0007140: 4c != e9
  620. 27c8.36b8: 00007ffdf3fe7141 / 0x0007141: 8b != 19
  621. 27c8.36b8: 00007ffdf3fe7142 / 0x0007142: dc != 97
  622. 27c8.36b8: 00007ffdf3fe7143 / 0x0007143: 48 != 98
  623. 27c8.36b8: 00007ffdf3fe7144 / 0x0007144: 83 != 02
  624. 27c8.36b8: 00007ffdf3fe7145 / 0x0007145: ec != cc
  625. 27c8.36b8: 00007ffdf3fe7146 / 0x0007146: 68 != cc
  626. 27c8.36b8: 00007ffdf3fe71c0 / 0x00071c0: 4c != e9
  627. 27c8.36b8: 00007ffdf3fe71c1 / 0x00071c1: 8b != 66
  628. 27c8.36b8: 00007ffdf3fe71c2 / 0x00071c2: dc != 96
  629. 27c8.36b8: 00007ffdf3fe71c3 / 0x00071c3: 48 != 98
  630. 27c8.36b8: 00007ffdf3fe71c4 / 0x00071c4: 83 != 02
  631. 27c8.36b8: 00007ffdf3fe71c5 / 0x00071c5: ec != cc
  632. 27c8.36b8: 00007ffdf3fe71c6 / 0x00071c6: 68 != cc
  633. 27c8.36b8: 00007ffdf3fe7240 / 0x0007240: 4c != e9
  634. 27c8.36b8: 00007ffdf3fe7241 / 0x0007241: 89 != 50
  635. 27c8.36b8: 00007ffdf3fe7242 / 0x0007242: 4c != 92
  636. 27c8.36b8: 00007ffdf3fe7243 / 0x0007243: 24 != 98
  637. 27c8.36b8: 00007ffdf3fe7244 / 0x0007244: 20 != 02
  638. 27c8.36b8: 00007ffdf3fe7e90 / 0x0007e90: 40 != e9
  639. 27c8.36b8: 00007ffdf3fe7e91 / 0x0007e91: 53 != 33
  640. 27c8.36b8: 00007ffdf3fe7e92 / 0x0007e92: 56 != 86
  641. 27c8.36b8: 00007ffdf3fe7e93 / 0x0007e93: 57 != 98
  642. 27c8.36b8: 00007ffdf3fe7e94 / 0x0007e94: 41 != 02
  643. 27c8.36b8: 00007ffdf3fe7e95 / 0x0007e95: 54 != cc
  644. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf3fe7000
  645. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  646. 27c8.36b8: 00007ffdf3ff10c0 / 0x00110c0: 48 != e9
  647. 27c8.36b8: 00007ffdf3ff10c1 / 0x00110c1: 83 != d3
  648. 27c8.36b8: 00007ffdf3ff10c2 / 0x00110c2: ec != f0
  649. 27c8.36b8: 00007ffdf3ff10c3 / 0x00110c3: 38 != 97
  650. 27c8.36b8: 00007ffdf3ff10c4 / 0x00110c4: b8 != 02
  651. 27c8.36b8: 00007ffdf3ff10c5 / 0x00110c5: 03 != cc
  652. 27c8.36b8: 00007ffdf3ff10c6 / 0x00110c6: 00 != cc
  653. 27c8.36b8: 00007ffdf3ff10c7 / 0x00110c7: 00 != cc
  654. 27c8.36b8: 00007ffdf3ff10c8 / 0x00110c8: 00 != cc
  655. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf3ff1000
  656. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  657. 27c8.36b8: 00007ffdf400a350 / 0x002a350: 40 != e9
  658. 27c8.36b8: 00007ffdf400a351 / 0x002a351: 53 != 3e
  659. 27c8.36b8: 00007ffdf400a352 / 0x002a352: 48 != 63
  660. 27c8.36b8: 00007ffdf400a353 / 0x002a353: 83 != 96
  661. 27c8.36b8: 00007ffdf400a354 / 0x002a354: ec != 02
  662. 27c8.36b8: 00007ffdf400a355 / 0x002a355: 20 != cc
  663. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4009000
  664. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  665. 27c8.36b8: 00007ffdf4011a00 / 0x0031a00: 40 != e9
  666. 27c8.36b8: 00007ffdf4011a01 / 0x0031a01: 55 != f3
  667. 27c8.36b8: 00007ffdf4011a02 / 0x0031a02: 53 != ed
  668. 27c8.36b8: 00007ffdf4011a03 / 0x0031a03: 56 != 95
  669. 27c8.36b8: 00007ffdf4011a04 / 0x0031a04: 57 != 02
  670. 27c8.36b8: 00007ffdf4011ef0 / 0x0031ef0: 4c != e9
  671. 27c8.36b8: 00007ffdf4011ef1 / 0x0031ef1: 8b != 39
  672. 27c8.36b8: 00007ffdf4011ef2 / 0x0031ef2: dc != e6
  673. 27c8.36b8: 00007ffdf4011ef3 / 0x0031ef3: 48 != 95
  674. 27c8.36b8: 00007ffdf4011ef4 / 0x0031ef4: 83 != 02
  675. 27c8.36b8: 00007ffdf4011ef5 / 0x0031ef5: ec != cc
  676. 27c8.36b8: 00007ffdf4011ef6 / 0x0031ef6: 68 != cc
  677. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4011000
  678. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  679. 27c8.36b8: 00007ffdf4014ce0 / 0x0034ce0: 40 != e9
  680. 27c8.36b8: 00007ffdf4014ce1 / 0x0034ce1: 53 != 76
  681. 27c8.36b8: 00007ffdf4014ce2 / 0x0034ce2: 48 != be
  682. 27c8.36b8: 00007ffdf4014ce3 / 0x0034ce3: 81 != 95
  683. 27c8.36b8: 00007ffdf4014ce4 / 0x0034ce4: ec != 02
  684. 27c8.36b8: 00007ffdf4014ce5 / 0x0034ce5: 80 != cc
  685. 27c8.36b8: 00007ffdf4014ce6 / 0x0034ce6: 00 != cc
  686. 27c8.36b8: 00007ffdf4014ce7 / 0x0034ce7: 00 != cc
  687. 27c8.36b8: 00007ffdf4014ce8 / 0x0034ce8: 00 != cc
  688. 27c8.36b8: 00007ffdf4014d70 / 0x0034d70: 40 != e9
  689. 27c8.36b8: 00007ffdf4014d71 / 0x0034d71: 53 != 19
  690. 27c8.36b8: 00007ffdf4014d72 / 0x0034d72: 48 != be
  691. 27c8.36b8: 00007ffdf4014d73 / 0x0034d73: 81 != 95
  692. 27c8.36b8: 00007ffdf4014d74 / 0x0034d74: ec != 02
  693. 27c8.36b8: 00007ffdf4014d75 / 0x0034d75: 80 != cc
  694. 27c8.36b8: 00007ffdf4014d76 / 0x0034d76: 00 != cc
  695. 27c8.36b8: 00007ffdf4014d77 / 0x0034d77: 00 != cc
  696. 27c8.36b8: 00007ffdf4014d78 / 0x0034d78: 00 != cc
  697. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4013000
  698. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  699. 27c8.36b8: 00007ffdf40152e0 / 0x00352e0: 4c != e9
  700. 27c8.36b8: 00007ffdf40152e1 / 0x00352e1: 8b != e4
  701. 27c8.36b8: 00007ffdf40152e2 / 0x00352e2: dc != b0
  702. 27c8.36b8: 00007ffdf40152e3 / 0x00352e3: 53 != 95
  703. 27c8.36b8: 00007ffdf40152e4 / 0x00352e4: 56 != 02
  704. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4015000
  705. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  706. 27c8.36b8: 00007ffdf40206a0 / 0x00406a0: 48 != e9
  707. 27c8.36b8: 00007ffdf40206a1 / 0x00406a1: 89 != ec
  708. 27c8.36b8: 00007ffdf40206a2 / 0x00406a2: 5c != 01
  709. 27c8.36b8: 00007ffdf40206a3 / 0x00406a3: 24 != 95
  710. 27c8.36b8: 00007ffdf40206a4 / 0x00406a4: 18 != 02
  711. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf401f000
  712. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  713. 27c8.36b8: 00007ffdf402dcb0 / 0x004dcb0: 48 != e9
  714. 27c8.36b8: 00007ffdf402dcb1 / 0x004dcb1: 83 != 10
  715. 27c8.36b8: 00007ffdf402dcb2 / 0x004dcb2: ec != 2b
  716. 27c8.36b8: 00007ffdf402dcb3 / 0x004dcb3: 38 != 94
  717. 27c8.36b8: 00007ffdf402dcb4 / 0x004dcb4: 48 != 02
  718. 27c8.36b8: 00007ffdf402dcb5 / 0x004dcb5: 83 != cc
  719. 27c8.36b8: 00007ffdf402dcb6 / 0x004dcb6: 64 != cc
  720. 27c8.36b8: 00007ffdf402dcb7 / 0x004dcb7: 24 != cc
  721. 27c8.36b8: 00007ffdf402dcb8 / 0x004dcb8: 28 != cc
  722. 27c8.36b8: 00007ffdf402dcb9 / 0x004dcb9: 00 != cc
  723. 27c8.36b8: 00007ffdf402dce0 / 0x004dce0: 48 != e9
  724. 27c8.36b8: 00007ffdf402dce1 / 0x004dce1: 83 != 7a
  725. 27c8.36b8: 00007ffdf402dce2 / 0x004dce2: ec != 2a
  726. 27c8.36b8: 00007ffdf402dce3 / 0x004dce3: 38 != 94
  727. 27c8.36b8: 00007ffdf402dce4 / 0x004dce4: 48 != 02
  728. 27c8.36b8: 00007ffdf402dce5 / 0x004dce5: 83 != cc
  729. 27c8.36b8: 00007ffdf402dce6 / 0x004dce6: 64 != cc
  730. 27c8.36b8: 00007ffdf402dce7 / 0x004dce7: 24 != cc
  731. 27c8.36b8: 00007ffdf402dce8 / 0x004dce8: 28 != cc
  732. 27c8.36b8: 00007ffdf402dce9 / 0x004dce9: 00 != cc
  733. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf402d000
  734. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  735. 27c8.36b8: 00007ffdf403e860 / 0x005e860: 48 != e9
  736. 27c8.36b8: 00007ffdf403e861 / 0x005e861: 8b != 28
  737. 27c8.36b8: 00007ffdf403e862 / 0x005e862: c4 != 24
  738. 27c8.36b8: 00007ffdf403e863 / 0x005e863: 48 != 93
  739. 27c8.36b8: 00007ffdf403e864 / 0x005e864: 89 != 02
  740. 27c8.36b8: 00007ffdf403e865 / 0x005e865: 58 != cc
  741. 27c8.36b8: 00007ffdf403e866 / 0x005e866: 08 != cc
  742. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf403d000
  743. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  744. 27c8.36b8: 00007ffdf404c370 / 0x006c370: 40 != e9
  745. 27c8.36b8: 00007ffdf404c371 / 0x006c371: 53 != ef
  746. 27c8.36b8: 00007ffdf404c372 / 0x006c372: 48 != 3e
  747. 27c8.36b8: 00007ffdf404c373 / 0x006c373: 83 != 92
  748. 27c8.36b8: 00007ffdf404c374 / 0x006c374: ec != 02
  749. 27c8.36b8: 00007ffdf404c375 / 0x006c375: 30 != cc
  750. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf404b000
  751. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  752. 27c8.36b8: 00007ffdf404d250 / 0x006d250: 48 != e9
  753. 27c8.36b8: 00007ffdf404d251 / 0x006d251: 89 != d2
  754. 27c8.36b8: 00007ffdf404d252 / 0x006d252: 5c != 39
  755. 27c8.36b8: 00007ffdf404d253 / 0x006d253: 24 != 92
  756. 27c8.36b8: 00007ffdf404d254 / 0x006d254: 10 != 02
  757. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf404d000
  758. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  759. 27c8.36b8: 00007ffdf404fc80 / 0x006fc80: 48 != e9
  760. 27c8.36b8: 00007ffdf404fc81 / 0x006fc81: 89 != ac
  761. 27c8.36b8: 00007ffdf404fc82 / 0x006fc82: 5c != 05
  762. 27c8.36b8: 00007ffdf404fc83 / 0x006fc83: 24 != 92
  763. 27c8.36b8: 00007ffdf404fc84 / 0x006fc84: 08 != 02
  764. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf404f000
  765. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  766. 27c8.36b8: 00007ffdf4053c80 / 0x0073c80: 48 != e9
  767. 27c8.36b8: 00007ffdf4053c81 / 0x0073c81: 8b != 0f
  768. 27c8.36b8: 00007ffdf4053c82 / 0x0073c82: c4 != c9
  769. 27c8.36b8: 00007ffdf4053c83 / 0x0073c83: 48 != 91
  770. 27c8.36b8: 00007ffdf4053c84 / 0x0073c84: 89 != 02
  771. 27c8.36b8: 00007ffdf4053c85 / 0x0073c85: 58 != cc
  772. 27c8.36b8: 00007ffdf4053c86 / 0x0073c86: 08 != cc
  773. 27c8.36b8: 00007ffdf4054e60 / 0x0074e60: 89 != e9
  774. 27c8.36b8: 00007ffdf4054e61 / 0x0074e61: 4c != 8f
  775. 27c8.36b8: 00007ffdf4054e62 / 0x0074e62: 24 != bd
  776. 27c8.36b8: 00007ffdf4054e63 / 0x0074e63: 08 != 91
  777. 27c8.36b8: 00007ffdf4054e64 / 0x0074e64: 48 != 02
  778. 27c8.36b8: 00007ffdf4054e65 / 0x0074e65: 83 != cc
  779. 27c8.36b8: 00007ffdf4054e66 / 0x0074e66: ec != cc
  780. 27c8.36b8: 00007ffdf4054e67 / 0x0074e67: 38 != cc
  781. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4053000
  782. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  783. 27c8.36b8: 00007ffdf4058c30 / 0x0078c30: 48 != e9
  784. 27c8.36b8: 00007ffdf4058c31 / 0x0078c31: 89 != 8f
  785. 27c8.36b8: 00007ffdf4058c32 / 0x0078c32: 5c != 7c
  786. 27c8.36b8: 00007ffdf4058c33 / 0x0078c33: 24 != 91
  787. 27c8.36b8: 00007ffdf4058c34 / 0x0078c34: 08 != 02
  788. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4057000
  789. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  790. 27c8.36b8: 00007ffdf4059c10 / 0x0079c10: 45 != e9
  791. 27c8.36b8: 00007ffdf4059c11 / 0x0079c11: 33 != e2
  792. 27c8.36b8: 00007ffdf4059c12 / 0x0079c12: c0 != 6c
  793. 27c8.36b8: 00007ffdf4059c13 / 0x0079c13: 33 != 91
  794. 27c8.36b8: 00007ffdf4059c14 / 0x0079c14: d2 != 02
  795. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf4059000
  796. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  797. 27c8.36b8: 00007ffdf405c800 / 0x007c800: 48 != e9
  798. 27c8.36b8: 00007ffdf405c801 / 0x007c801: 89 != bc
  799. 27c8.36b8: 00007ffdf405c802 / 0x007c802: 5c != 43
  800. 27c8.36b8: 00007ffdf405c803 / 0x007c803: 24 != 91
  801. 27c8.36b8: 00007ffdf405c804 / 0x007c804: 08 != 02
  802. 27c8.36b8: 00007ffdf405cd50 / 0x007cd50: 48 != e9
  803. 27c8.36b8: 00007ffdf405cd51 / 0x007cd51: 89 != d5
  804. 27c8.36b8: 00007ffdf405cd52 / 0x007cd52: 5c != 3b
  805. 27c8.36b8: 00007ffdf405cd53 / 0x007cd53: 24 != 91
  806. 27c8.36b8: 00007ffdf405cd54 / 0x007cd54: 08 != 02
  807. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf405b000
  808. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  809. 27c8.36b8: 00007ffdf40dd390 / 0x00fd390: 48 != e9
  810. 27c8.36b8: 00007ffdf40dd391 / 0x00fd391: 83 != d0
  811. 27c8.36b8: 00007ffdf40dd392 / 0x00fd392: ec != 2d
  812. 27c8.36b8: 00007ffdf40dd393 / 0x00fd393: 38 != 89
  813. 27c8.36b8: 00007ffdf40dd394 / 0x00fd394: b8 != 02
  814. 27c8.36b8: 00007ffdf40dd395 / 0x00fd395: 03 != cc
  815. 27c8.36b8: 00007ffdf40dd396 / 0x00fd396: 00 != cc
  816. 27c8.36b8: 00007ffdf40dd397 / 0x00fd397: 00 != cc
  817. 27c8.36b8: 00007ffdf40dd398 / 0x00fd398: 00 != cc
  818. 27c8.36b8: 00007ffdf40dd3c0 / 0x00fd3c0: 48 != e9
  819. 27c8.36b8: 00007ffdf40dd3c1 / 0x00fd3c1: 83 != 3a
  820. 27c8.36b8: 00007ffdf40dd3c2 / 0x00fd3c2: ec != 2d
  821. 27c8.36b8: 00007ffdf40dd3c3 / 0x00fd3c3: 38 != 89
  822. 27c8.36b8: 00007ffdf40dd3c4 / 0x00fd3c4: 33 != 02
  823. 27c8.36b8: 00007ffdf40dd3c5 / 0x00fd3c5: c0 != cc
  824. 27c8.36b8: 00007ffdf40dd440 / 0x00fd440: 48 != e9
  825. 27c8.36b8: 00007ffdf40dd441 / 0x00fd441: 83 != ed
  826. 27c8.36b8: 00007ffdf40dd442 / 0x00fd442: ec != 2c
  827. 27c8.36b8: 00007ffdf40dd443 / 0x00fd443: 38 != 89
  828. 27c8.36b8: 00007ffdf40dd444 / 0x00fd444: 33 != 02
  829. 27c8.36b8: 00007ffdf40dd445 / 0x00fd445: c0 != cc
  830. 27c8.36b8: 00007ffdf40dd8c0 / 0x00fd8c0: 40 != e9
  831. 27c8.36b8: 00007ffdf40dd8c1 / 0x00fd8c1: 53 != 98
  832. 27c8.36b8: 00007ffdf40dd8c2 / 0x00fd8c2: 48 != 30
  833. 27c8.36b8: 00007ffdf40dd8c3 / 0x00fd8c3: 81 != 89
  834. 27c8.36b8: 00007ffdf40dd8c4 / 0x00fd8c4: ec != 02
  835. 27c8.36b8: 00007ffdf40dd8c5 / 0x00fd8c5: 90 != cc
  836. 27c8.36b8: 00007ffdf40dd8c6 / 0x00fd8c6: 00 != cc
  837. 27c8.36b8: 00007ffdf40dd8c7 / 0x00fd8c7: 00 != cc
  838. 27c8.36b8: 00007ffdf40dd8c8 / 0x00fd8c8: 00 != cc
  839. 27c8.36b8: 00007ffdf40de270 / 0x00fe270: 40 != e9
  840. 27c8.36b8: 00007ffdf40de271 / 0x00fe271: 53 != 24
  841. 27c8.36b8: 00007ffdf40de272 / 0x00fe272: 48 != 1e
  842. 27c8.36b8: 00007ffdf40de273 / 0x00fe273: 83 != 89
  843. 27c8.36b8: 00007ffdf40de274 / 0x00fe274: ec != 02
  844. 27c8.36b8: 00007ffdf40de275 / 0x00fe275: 30 != cc
  845. 27c8.36b8: 00007ffdf40de4b0 / 0x00fe4b0: 40 != e9
  846. 27c8.36b8: 00007ffdf40de4b1 / 0x00fe4b1: 53 != 17
  847. 27c8.36b8: 00007ffdf40de4b2 / 0x00fe4b2: 48 != 1c
  848. 27c8.36b8: 00007ffdf40de4b3 / 0x00fe4b3: 83 != 89
  849. 27c8.36b8: 00007ffdf40de4b4 / 0x00fe4b4: ec != 02
  850. 27c8.36b8: 00007ffdf40de4b5 / 0x00fe4b5: 30 != cc
  851. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf40dd000
  852. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  853. 27c8.36b8: 00007ffdf40e65a0 / 0x01065a0: 4c != e9
  854. 27c8.36b8: 00007ffdf40e65a1 / 0x01065a1: 8b != f1
  855. 27c8.36b8: 00007ffdf40e65a2 / 0x01065a2: dc != 9d
  856. 27c8.36b8: 00007ffdf40e65a3 / 0x01065a3: 48 != 88
  857. 27c8.36b8: 00007ffdf40e65a4 / 0x01065a4: 83 != 02
  858. 27c8.36b8: 00007ffdf40e65a5 / 0x01065a5: ec != cc
  859. 27c8.36b8: 00007ffdf40e65a6 / 0x01065a6: 48 != cc
  860. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf40e5000
  861. 27c8.36b8: kernelbase.dll: Differences in section #1 (.text) between file and memory:
  862. 27c8.36b8: 00007ffdf40ea490 / 0x010a490: 48 != e9
  863. 27c8.36b8: 00007ffdf40ea491 / 0x010a491: 8b != c5
  864. 27c8.36b8: 00007ffdf40ea492 / 0x010a492: c4 != 67
  865. 27c8.36b8: 00007ffdf40ea493 / 0x010a493: 48 != 88
  866. 27c8.36b8: 00007ffdf40ea494 / 0x010a494: 89 != 02
  867. 27c8.36b8: 00007ffdf40ea495 / 0x010a495: 58 != cc
  868. 27c8.36b8: 00007ffdf40ea496 / 0x010a496: 08 != cc
  869. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf40e9000
  870. 27c8.36b8: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=28
  871. 27c8.36b8: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  872. 27c8.36b8: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  873. 27c8.36b8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  874. 27c8.36b8: supR3HardNtEnableThreadCreationEx:
  875. 27c8.36b8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffdf67e4b00 pvNtTerminateThread=00007ffdf680d7c0
  876. 27c8.36b8: supR3HardenedWinDoReSpawn(1): New child 6558.2ef4 [kernel32].
  877. 27c8.36b8: supR3HardNtChildGatherData: PebBaseAddress=0000000000501000 cbPeb=0x388
  878. 27c8.36b8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffdf6770000 uNtDllChildAddr=00007ffdf6770000
  879. 27c8.36b8: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffdf67e4b00
  880. 27c8.36b8: supR3HardenedWinSetupChildInit: Initial context:
  881. rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7ac767900 rdx=0000000000501000
  882. rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  883. r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  884. r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
  885. rip=00007ffdf67c2630 rsp=00000000003afaf8 rbp=0000000000000000 ctxflags=0010001b
  886. cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
  887. P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
  888. dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  889. dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  890. lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
  891. 27c8.36b8: supR3HardenedWinSetupChildInit: Start child.
  892. 27c8.36b8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  893. 27c8.36b8: supR3HardNtChildPurify: Startup delay kludge #1/0: 266 ms, 17 sleeps
  894. 27c8.36b8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  895. 27c8.36b8: *0000000000000000-000000000026ffff 0x0001/0x0000 0x0000000
  896. 27c8.36b8: *0000000000270000-000000000028ffff 0x0004/0x0004 0x0020000
  897. 27c8.36b8: *0000000000290000-00000000002acfff 0x0002/0x0002 0x0040000
  898. 27c8.36b8: 00000000002ad000-00000000002affff 0x0001/0x0000 0x0000000
  899. 27c8.36b8: *00000000002b0000-00000000003aafff 0x0000/0x0004 0x0020000
  900. 27c8.36b8: 00000000003ab000-00000000003adfff 0x0104/0x0004 0x0020000
  901. 27c8.36b8: 00000000003ae000-00000000003affff 0x0004/0x0004 0x0020000
  902. 27c8.36b8: *00000000003b0000-00000000003b3fff 0x0002/0x0002 0x0040000
  903. 27c8.36b8: 00000000003b4000-00000000003bffff 0x0001/0x0000 0x0000000
  904. 27c8.36b8: *00000000003c0000-00000000003c1fff 0x0004/0x0004 0x0020000
  905. 27c8.36b8: 00000000003c2000-00000000003fffff 0x0001/0x0000 0x0000000
  906. 27c8.36b8: *0000000000400000-0000000000500fff 0x0000/0x0004 0x0020000
  907. 27c8.36b8: 0000000000501000-0000000000503fff 0x0004/0x0004 0x0020000
  908. 27c8.36b8: 0000000000504000-00000000005fffff 0x0000/0x0004 0x0020000
  909. 27c8.36b8: 0000000000600000-000000007ffdffff 0x0001/0x0000 0x0000000
  910. 27c8.36b8: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  911. 27c8.36b8: 000000007ffe1000-000000007ffeafff 0x0001/0x0000 0x0000000
  912. 27c8.36b8: *000000007ffeb000-000000007ffebfff 0x0002/0x0002 0x0020000
  913. 27c8.36b8: 000000007ffec000-00007ff54788ffff 0x0001/0x0000 0x0000000
  914. 27c8.36b8: *00007ff547890000-00007ff547890fff 0x0020/0x0004 0x0020000 !!
  915. 27c8.36b8: supHardNtVpFreeOrReplacePrivateExecMemory: Freeing exec mem at 00007ff547890000 (LB 0x1000, 00007ff547890000 LB 0x1000)
  916. 27c8.36b8: 0000000001719570/0000: 16 00 20 00 00 00 00 00-10 00 89 47 f5 7f 00 00 .. ........G....
  917. 0000000001719580/0010: 61 00 74 00 63 00 75 00-66 00 36 00 34 00 2e 00 a.t.c.u.f.6.4...
  918. 0000000001719590/0020: 64 00 6c 00 6c 00 00 00-00 00 00 00 00 00 00 00 d.l.l...........
  919. 00000000017195a0/0030: 43 00 3a 00 5c 00 50 00-72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
  920. 00000000017195b0/0040: 61 00 6d 00 20 00 46 00-69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
  921. 00000000017195c0/0050: 5c 00 42 00 69 00 74 00-64 00 65 00 66 00 65 00 \.B.i.t.d.e.f.e.
  922. 00000000017195d0/0060: 6e 00 64 00 65 00 72 00-20 00 41 00 6e 00 74 00 n.d.e.r. .A.n.t.
  923. 00000000017195e0/0070: 69 00 76 00 69 00 72 00-75 00 73 00 20 00 46 00 i.v.i.r.u.s. .F.
  924. 00000000017195f0/0080: 72 00 65 00 65 00 5c 00-61 00 74 00 63 00 75 00 r.e.e.\.a.t.c.u.
  925. 0000000001719600/0090: 66 00 5c 00 64 00 6c 00-6c 00 73 00 5f 00 32 00 f.\.d.l.l.s._.2.
  926. 0000000001719610/00a0: 36 00 35 00 36 00 39 00-31 00 32 00 36 00 37 00 6.5.6.9.1.2.6.7.
  927. 0000000001719620/00b0: 30 00 35 00 32 00 36 00-39 00 36 00 34 00 35 00 0.5.2.6.9.6.4.5.
  928. 0000000001719630/00c0: 34 00 5c 00 00 00 00 00-00 00 00 00 00 00 00 00 4.\.............
  929. 0000000001719640/00d0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  930. 0000000001719650/00e0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  931. 0000000001719660/00f0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  932. 27c8.36b8: 0000000001719970/0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  933. **************** **** <ditto x 2>
  934. 00000000017199a0/0030: 16 00 20 00 00 00 00 00-40 04 89 47 f5 7f 00 00 .. .....@..G....
  935. 00000000017199b0/0040: 62 00 64 00 68 00 6b 00-6d 00 36 00 34 00 2e 00 b.d.h.k.m.6.4...
  936. 00000000017199c0/0050: 64 00 6c 00 6c 00 00 00-00 00 00 00 00 00 00 00 d.l.l...........
  937. 00000000017199d0/0060: 43 00 3a 00 5c 00 50 00-72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
  938. 00000000017199e0/0070: 61 00 6d 00 20 00 46 00-69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
  939. 00000000017199f0/0080: 5c 00 42 00 69 00 74 00-64 00 65 00 66 00 65 00 \.B.i.t.d.e.f.e.
  940. 0000000001719a00/0090: 6e 00 64 00 65 00 72 00-20 00 41 00 6e 00 74 00 n.d.e.r. .A.n.t.
  941. 0000000001719a10/00a0: 69 00 76 00 69 00 72 00-75 00 73 00 20 00 46 00 i.v.i.r.u.s. .F.
  942. 0000000001719a20/00b0: 72 00 65 00 65 00 5c 00-62 00 64 00 68 00 6b 00 r.e.e.\.b.d.h.k.
  943. 0000000001719a30/00c0: 6d 00 5c 00 64 00 6c 00-6c 00 73 00 5f 00 32 00 m.\.d.l.l.s._.2.
  944. 0000000001719a40/00d0: 36 00 35 00 36 00 39 00-31 00 32 00 36 00 37 00 6.5.6.9.1.2.6.7.
  945. 0000000001719a50/00e0: 30 00 36 00 32 00 37 00-32 00 32 00 31 00 37 00 0.6.2.7.2.2.1.7.
  946. 0000000001719a60/00f0: 37 00 5c 00 00 00 00 00-00 00 00 00 00 00 00 00 7.\.............
  947. 27c8.36b8: 0000000001719d70/0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  948. **************** **** <ditto x 5>
  949. 0000000001719dd0/0060: 10 6a 78 f6 fd 7f 00 00-60 d7 80 f6 fd 7f 00 00 .jx.....`.......
  950. 0000000001719de0/0070: 48 89 5c 24 10 56 57 41-56 48 81 ec d0 00 00 00 H.\$.VWAVH......
  951. 0000000001719df0/0080: 48 83 ec 38 56 57 51 52-41 50 41 51 48 83 ec 40 H..8VWQRAPAQH..@
  952. 0000000001719e00/0090: 48 b9 ff ff ff ff ff ff-ff ff 48 8b 15 bf ff ff H.........H.....
  953. 0000000001719e10/00a0: ff 48 89 54 24 38 48 8d-54 24 38 48 c7 44 24 28 .H.T$8H.T$8H.D$(
  954. 0000000001719e20/00b0: 10 00 00 00 4c 8d 44 24-28 49 c7 c1 04 00 00 00 ....L.D$(I......
  955. 0000000001719e30/00c0: 48 8d 7c 24 30 48 89 7c-24 20 48 8b 05 97 ff ff H.|$0H.|$ H.....
  956. 0000000001719e40/00d0: ff ff d0 85 c0 0f 88 00-01 00 00 48 8d 35 8e ff ...........H.5..
  957. 0000000001719e50/00e0: ff ff 48 8b 3d 77 ff ff-ff 48 c7 c1 10 00 00 00 ..H.=w...H......
  958. 0000000001719e60/00f0: fc f3 a4 48 b9 ff ff ff-ff ff ff ff ff 48 8b 15 ...H.........H..
  959. 27c8.36b8: 0000000001719e70/0000: 5c ff ff ff 48 89 54 24-38 48 8d 54 24 38 48 c7 \...H.T$8H.T$8H.
  960. 0000000001719e80/0010: 44 24 28 10 00 00 00 4c-8d 44 24 28 4c 8b 4c 24 D$(....L.D$(L.L$
  961. 0000000001719e90/0020: 30 48 8d 7c 24 30 48 89-7c 24 20 48 8b 05 36 ff 0H.|$0H.|$ H..6.
  962. 0000000001719ea0/0030: ff ff ff d0 85 c0 0f 88-9f 00 00 00 48 83 c4 40 ............H..@
  963. 0000000001719eb0/0040: 41 59 41 58 5a 59 5f 5e-48 8b 05 11 ff ff ff 48 AYAXZY_^H......H
  964. 0000000001719ec0/0050: 83 ec 20 ff d0 48 83 c4-20 85 c0 0f 88 86 00 00 .. ..H.. .......
  965. 0000000001719ed0/0060: 00 65 48 8b 0c 25 60 00-00 00 ba 00 01 00 02 85 .eH..%`.........
  966. 0000000001719ee0/0070: 91 bc 00 00 00 75 70 48-8d 0d e2 fa ff ff 48 c7 .....upH......H.
  967. 0000000001719ef0/0080: c2 00 00 00 00 4c 8d 05-a4 fa ff ff 4c 8d 4c 24 .....L......L.L$
  968. 0000000001719f00/0090: 20 48 8b 05 c8 fe ff ff-48 83 ec 20 ff d0 48 83 H......H.. ..H.
  969. 0000000001719f10/00a0: c4 20 85 c0 74 05 48 31-c0 eb 3c 48 8d 0d 7e f6 . ..t.H1..<H..~.
  970. 0000000001719f20/00b0: ff ff 48 c7 c2 00 00 00-00 4c 8d 05 40 f6 ff ff ..H......L..@...
  971. 0000000001719f30/00c0: 4c 8d 4c 24 20 48 8b 05-94 fe ff ff 48 83 ec 20 L.L$ H......H..
  972. 0000000001719f40/00d0: ff d0 48 83 c4 20 48 31-c0 eb 0c 48 83 c4 40 41 ..H.. H1...H..@A
  973. 0000000001719f50/00e0: 59 41 58 5a 59 5f 5e 48-83 c4 38 c3 00 00 00 00 YAXZY_^H..8.....
  974. 0000000001719f60/00f0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  975. 27c8.36b8: supHardNtVpFreeOrReplacePrivateExecMemory: Free attempt #1 succeeded: 0x0 [00007ff547890000/00007ff547890000 LB 0/0x1000]
  976. 27c8.36b8: supHardNtVpFreeOrReplacePrivateExecMemory: QVM after free 0: [0000000000000000]/00007ff547890000 LB 0x10000 s=0x10000 ap=0x0 rp=0x00000000000001
  977. 27c8.36b8: 00007ff547891000-00007ff54789ffff 0x0001/0x0000 0x0000000
  978. 27c8.36b8: *00007ff5478a0000-00007ff5478a0fff 0x0002/0x0002 0x0040000
  979. 27c8.36b8: 00007ff5478a1000-00007ff5478affff 0x0001/0x0000 0x0000000
  980. 27c8.36b8: *00007ff5478b0000-00007ff5478d2fff 0x0002/0x0002 0x0040000
  981. 27c8.36b8: 00007ff5478d3000-00007ff7ac75ffff 0x0001/0x0000 0x0000000
  982. 27c8.36b8: *00007ff7ac760000-00007ff7ac760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  983. 27c8.36b8: 00007ff7ac761000-00007ff7ac7d7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  984. 27c8.36b8: 00007ff7ac7d8000-00007ff7ac7d8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  985. 27c8.36b8: 00007ff7ac7d9000-00007ff7ac821fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  986. 27c8.36b8: 00007ff7ac822000-00007ff7ac822fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  987. 27c8.36b8: 00007ff7ac823000-00007ff7ac823fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  988. 27c8.36b8: 00007ff7ac824000-00007ff7ac828fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  989. 27c8.36b8: 00007ff7ac829000-00007ff7ac829fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  990. 27c8.36b8: 00007ff7ac82a000-00007ff7ac82afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  991. 27c8.36b8: 00007ff7ac82b000-00007ff7ac82efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  992. 27c8.36b8: 00007ff7ac82f000-00007ff7ac877fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  993. 27c8.36b8: 00007ff7ac878000-00007ffdf676ffff 0x0001/0x0000 0x0000000
  994. 27c8.36b8: *00007ffdf6770000-00007ffdf6770fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  995. 27c8.36b8: 00007ffdf6771000-00007ffdf688bfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  996. 27c8.36b8: 00007ffdf688c000-00007ffdf68d3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  997. 27c8.36b8: 00007ffdf68d4000-00007ffdf68dffff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  998. 27c8.36b8: 00007ffdf68e0000-00007ffdf68eefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  999. 27c8.36b8: 00007ffdf68ef000-00007ffdf68effff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1000. 27c8.36b8: 00007ffdf68f0000-00007ffdf68f2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1001. 27c8.36b8: 00007ffdf68f3000-00007ffdf6964fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1002. 27c8.36b8: 00007ffdf6965000-00007ffffffeffff 0x0001/0x0000 0x0000000
  1003. 27c8.36b8: ntdll.dll: Differences in section #1 (.text) between file and memory:
  1004. 27c8.36b8: 00007ffdf6786a11 / 0x0016a11: 89 != b8
  1005. 27c8.36b8: 00007ffdf6786a12 / 0x0016a12: 5c != 80
  1006. 27c8.36b8: 00007ffdf6786a13 / 0x0016a13: 24 != 08
  1007. 27c8.36b8: 00007ffdf6786a14 / 0x0016a14: 10 != 89
  1008. 27c8.36b8: 00007ffdf6786a15 / 0x0016a15: 56 != 47
  1009. 27c8.36b8: 00007ffdf6786a16 / 0x0016a16: 57 != f5
  1010. 27c8.36b8: 00007ffdf6786a17 / 0x0016a17: 41 != 7f
  1011. 27c8.36b8: 00007ffdf6786a18 / 0x0016a18: 56 != 00
  1012. 27c8.36b8: 00007ffdf6786a19 / 0x0016a19: 48 != 00
  1013. 27c8.36b8: 00007ffdf6786a1a / 0x0016a1a: 81 != ff
  1014. 27c8.36b8: 00007ffdf6786a1b / 0x0016a1b: ec != e0
  1015. 27c8.36b8: Restored 0x2000 bytes of original file content at 00007ffdf6785000
  1016. 27c8.36b8: supR3HardNtChildPurify: cFixes=2 g_fSupAdversaries=0x80000000
  1017. 27c8.36b8: supR3HardNtChildPurify: Startup delay kludge #1/1: 528 ms, 34 sleeps
  1018. 27c8.36b8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  1019. 27c8.36b8: *0000000000000000-000000000026ffff 0x0001/0x0000 0x0000000
  1020. 27c8.36b8: *0000000000270000-000000000028ffff 0x0004/0x0004 0x0020000
  1021. 27c8.36b8: *0000000000290000-00000000002acfff 0x0002/0x0002 0x0040000
  1022. 27c8.36b8: 00000000002ad000-00000000002affff 0x0001/0x0000 0x0000000
  1023. 27c8.36b8: *00000000002b0000-00000000003aafff 0x0000/0x0004 0x0020000
  1024. 27c8.36b8: 00000000003ab000-00000000003adfff 0x0104/0x0004 0x0020000
  1025. 27c8.36b8: 00000000003ae000-00000000003affff 0x0004/0x0004 0x0020000
  1026. 27c8.36b8: *00000000003b0000-00000000003b3fff 0x0002/0x0002 0x0040000
  1027. 27c8.36b8: 00000000003b4000-00000000003bffff 0x0001/0x0000 0x0000000
  1028. 27c8.36b8: *00000000003c0000-00000000003c1fff 0x0004/0x0004 0x0020000
  1029. 27c8.36b8: 00000000003c2000-00000000003fffff 0x0001/0x0000 0x0000000
  1030. 27c8.36b8: *0000000000400000-0000000000500fff 0x0000/0x0004 0x0020000
  1031. 27c8.36b8: 0000000000501000-0000000000503fff 0x0004/0x0004 0x0020000
  1032. 27c8.36b8: 0000000000504000-00000000005fffff 0x0000/0x0004 0x0020000
  1033. 27c8.36b8: 0000000000600000-000000007ffdffff 0x0001/0x0000 0x0000000
  1034. 27c8.36b8: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  1035. 27c8.36b8: 000000007ffe1000-000000007ffeafff 0x0001/0x0000 0x0000000
  1036. 27c8.36b8: *000000007ffeb000-000000007ffebfff 0x0002/0x0002 0x0020000
  1037. 27c8.36b8: 000000007ffec000-00007ff54789ffff 0x0001/0x0000 0x0000000
  1038. 27c8.36b8: *00007ff5478a0000-00007ff5478a0fff 0x0002/0x0002 0x0040000
  1039. 27c8.36b8: 00007ff5478a1000-00007ff5478affff 0x0001/0x0000 0x0000000
  1040. 27c8.36b8: *00007ff5478b0000-00007ff5478d2fff 0x0002/0x0002 0x0040000
  1041. 27c8.36b8: 00007ff5478d3000-00007ff7ac75ffff 0x0001/0x0000 0x0000000
  1042. 27c8.36b8: *00007ff7ac760000-00007ff7ac760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1043. 27c8.36b8: 00007ff7ac761000-00007ff7ac7d7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1044. 27c8.36b8: 00007ff7ac7d8000-00007ff7ac7d8fff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1045. 27c8.36b8: 00007ff7ac7d9000-00007ff7ac821fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1046. 27c8.36b8: 00007ff7ac822000-00007ff7ac82efff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1047. 27c8.36b8: 00007ff7ac82f000-00007ff7ac877fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1048. 27c8.36b8: 00007ff7ac878000-00007ffdf676ffff 0x0001/0x0000 0x0000000
  1049. 27c8.36b8: *00007ffdf6770000-00007ffdf6770fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1050. 27c8.36b8: 00007ffdf6771000-00007ffdf688bfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1051. 27c8.36b8: 00007ffdf688c000-00007ffdf68d3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1052. 27c8.36b8: 00007ffdf68d4000-00007ffdf68d7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1053. 27c8.36b8: 00007ffdf68d8000-00007ffdf68dffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1054. 27c8.36b8: 00007ffdf68e0000-00007ffdf68eefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1055. 27c8.36b8: 00007ffdf68ef000-00007ffdf68effff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1056. 27c8.36b8: 00007ffdf68f0000-00007ffdf68f2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1057. 27c8.36b8: 00007ffdf68f3000-00007ffdf6964fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1058. 27c8.36b8: 00007ffdf6965000-00007ffffffeffff 0x0001/0x0000 0x0000000
  1059. 27c8.36b8: supR3HardNtChildPurify: Done after 812 ms and 2 fixes (loop #1).
  1060. 6558.2ef4: Log file opened: 6.1.30r148432 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa04a6400
  1061. 6558.2ef4: supR3HardenedVmProcessInit: uNtDllAddr=00007ffdf6770000 g_uNtVerCombined=0xa04a6400 (stack ~00000000003af588)
  1062. 6558.2ef4: ntdll.dll: timestamp 0xa280d1d6 (rc=VINF_SUCCESS)
  1063. 27c8.36b8: supR3HardNtEnableThreadCreationEx:
  1064. 6558.2ef4: New simple heap: #1 0000000000700000 LB 0x400000 (for 2052096 allocation)
  1065. 6558.2ef4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1066. 6558.2ef4: System32: \Device\HarddiskVolume3\Windows\System32
  1067. 6558.2ef4: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  1068. 6558.2ef4: KnownDllPath: C:\WINDOWS\System32
  1069. 6558.2ef4: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  1070. 6558.2ef4: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  1071. 6558.2ef4: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  1072. 6558.2ef4: Registered Dll notification callback with NTDLL.
  1073. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  1074. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  1075. 6558.2ef4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  1076. 6558.2ef4: supR3HardenedDllNotificationCallback: load 00007ffdf3fe0000 LB 0x002c8000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  1077. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  1078. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  1079. 6558.2ef4: supR3HardenedDllNotificationCallback: load 00007ffdf63f0000 LB 0x000be000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  1080. 6558.2ef4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  1081. 6558.2ef4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  1082. 6558.2ef4: supR3HardenedDllNotificationCallback: load 00007ff7ac760000 LB 0x00118000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
  1083. 6558.2ef4: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  1084. 6558.2ef4: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  1085. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  1086. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1087. 6558.2ef4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffdf67e4b00 pvNtTerminateThread=00007ffdf680d7c0
  1088. 27c8.36b8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 83 ms.
  1089. 6558.2ef4: \SystemRoot\System32\ntdll.dll:
  1090. 6558.2ef4: CreationTime: 2021-10-06T13:39:54.967473200Z
  1091. 6558.2ef4: LastWriteTime: 2021-10-06T13:39:55.014335100Z
  1092. 6558.2ef4: ChangeTime: 2021-12-17T09:52:47.850888900Z
  1093. 6558.2ef4: FileAttributes: 0x20
  1094. 6558.2ef4: Size: 0x1ee520
  1095. 6558.2ef4: NT Headers: 0xe8
  1096. 6558.2ef4: Timestamp: 0xa280d1d6
  1097. 6558.2ef4: Machine: 0x8664 - amd64
  1098. 6558.2ef4: Timestamp: 0xa280d1d6
  1099. 6558.2ef4: Image Version: 10.0
  1100. 6558.2ef4: SizeOfImage: 0x1f5000 (2052096)
  1101. 6558.2ef4: Resource Dir: 0x184000 LB 0x6fdc8
  1102. 6558.2ef4: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1103. 6558.2ef4: [Raw version resource data: 0x1840f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  1104. 6558.2ef4: ProductName: Microsoft® Windows® Operating System
  1105. 6558.2ef4: ProductVersion: 10.0.19041.1288
  1106. 6558.2ef4: FileVersion: 10.0.19041.1288 (WinBuild.160101.0800)
  1107. 6558.2ef4: FileDescription: NT Layer DLL
  1108. 6558.2ef4: \SystemRoot\System32\kernel32.dll:
  1109. 6558.2ef4: CreationTime: 2021-12-02T15:03:52.492099300Z
  1110. 6558.2ef4: LastWriteTime: 2021-12-02T15:03:52.505102200Z
  1111. 6558.2ef4: ChangeTime: 2021-12-17T09:52:47.655061900Z
  1112. 6558.2ef4: FileAttributes: 0x20
  1113. 6558.2ef4: Size: 0xbc058
  1114. 6558.2ef4: NT Headers: 0xe8
  1115. 6558.2ef4: Timestamp: 0x38b369c4
  1116. 6558.2ef4: Machine: 0x8664 - amd64
  1117. 6558.2ef4: Timestamp: 0x38b369c4
  1118. 6558.2ef4: Image Version: 10.0
  1119. 6558.2ef4: SizeOfImage: 0xbe000 (778240)
  1120. 6558.2ef4: Resource Dir: 0xbc000 LB 0x520
  1121. 6558.2ef4: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1122. 6558.2ef4: [Raw version resource data: 0xbc0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  1123. 6558.2ef4: ProductName: Microsoft® Windows® Operating System
  1124. 6558.2ef4: ProductVersion: 10.0.19041.1348
  1125. 6558.2ef4: FileVersion: 10.0.19041.1348 (WinBuild.160101.0800)
  1126. 6558.2ef4: FileDescription: Windows NT BASE API Client DLL
  1127. 6558.2ef4: \SystemRoot\System32\KernelBase.dll:
  1128. 6558.2ef4: CreationTime: 2021-12-17T09:52:07.022047900Z
  1129. 6558.2ef4: LastWriteTime: 2021-12-17T09:52:07.089062400Z
  1130. 6558.2ef4: ChangeTime: 2021-12-18T17:56:07.323012400Z
  1131. 6558.2ef4: FileAttributes: 0x20
  1132. 6558.2ef4: Size: 0x2c9168
  1133. 6558.2ef4: NT Headers: 0xf0
  1134. 6558.2ef4: Timestamp: 0xb9a844a
  1135. 6558.2ef4: Machine: 0x8664 - amd64
  1136. 6558.2ef4: Timestamp: 0xb9a844a
  1137. 6558.2ef4: Image Version: 10.0
  1138. 6558.2ef4: SizeOfImage: 0x2c8000 (2916352)
  1139. 6558.2ef4: Resource Dir: 0x29f000 LB 0x548
  1140. 6558.2ef4: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1141. 6558.2ef4: [Raw version resource data: 0x29f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  1142. 6558.2ef4: ProductName: Microsoft® Windows® Operating System
  1143. 6558.2ef4: ProductVersion: 10.0.19041.1387
  1144. 6558.2ef4: FileVersion: 10.0.19041.1387 (WinBuild.160101.0800)
  1145. 6558.2ef4: FileDescription: Windows NT BASE API Client DLL
  1146. 6558.2ef4: \SystemRoot\System32\apisetschema.dll:
  1147. 6558.2ef4: CreationTime: 2019-12-07T09:08:13.518339400Z
  1148. 6558.2ef4: LastWriteTime: 2019-12-07T09:08:13.518339400Z
  1149. 6558.2ef4: ChangeTime: 2021-12-17T09:52:47.633058800Z
  1150. 6558.2ef4: FileAttributes: 0x20
  1151. 6558.2ef4: Size: 0x1f538
  1152. 6558.2ef4: NT Headers: 0xd0
  1153. 6558.2ef4: Timestamp: 0x31288ce0
  1154. 6558.2ef4: Machine: 0x8664 - amd64
  1155. 6558.2ef4: Timestamp: 0x31288ce0
  1156. 6558.2ef4: Image Version: 10.0
  1157. 6558.2ef4: SizeOfImage: 0x20000 (131072)
  1158. 6558.2ef4: Resource Dir: 0x1f000 LB 0x408
  1159. 6558.2ef4: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1160. 6558.2ef4: [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  1161. 6558.2ef4: ProductName: Microsoft® Windows® Operating System
  1162. 6558.2ef4: ProductVersion: 10.0.19041.1
  1163. 6558.2ef4: FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
  1164. 6558.2ef4: FileDescription: ApiSet Schema DLL
  1165. 6558.2ef4: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  1166. 6558.2ef4: supR3HardenedWinFindAdversaries: 0x0
  1167. 6558.2ef4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1168. 6558.2ef4: Calling main()
  1169. 6558.2ef4: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  1170. 6558.2ef4: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1171. 6558.2ef4: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  1172. 6558.2ef4: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  1173. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  1174. 6558.2ef4: SUPR3HardenedMain: Respawn #2
  1175. 6558.2ef4: supR3HardNtEnableThreadCreationEx:
  1176. 6558.2ef4: supR3HardenedDllNotificationCallback: load 00007ffdf5080000 LB 0x0012a000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  1177. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
  1178. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1179. 6558.2ef4: supR3HardenedDllNotificationCallback: load 00007ffdf4910000 LB 0x0009b000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  1180. 6558.2ef4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  1181. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
  1182. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
  1183. 6558.2ef4: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  1184. 6558.2ef4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntdll.dll)
  1185. 6558.2ef4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1186. 6558.2ef4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1187. 6558.2ef4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1188. 6558.2ef4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1189. 6558.2ef4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1190. 6558.2ef4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6770000 'C:\WINDOWS\System32\ntdll.dll'
  1191. 6558.2ef4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffdf67e4b00 pvNtTerminateThread=00007ffdf680d7c0
  1192. 6558.2ef4: supR3HardenedWinDoReSpawn(2): New child 3e68.3760 [kernel32].
  1193. 6558.2ef4: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
  1194. 6558.2ef4: supR3HardNtChildGatherData: PebBaseAddress=00000000008ab000 cbPeb=0x388
  1195. 6558.2ef4: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffdf6770000 uNtDllChildAddr=00007ffdf6770000
  1196. 6558.2ef4: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffdf67e4b00
  1197. 6558.2ef4: supR3HardenedWinSetupChildInit: Initial context:
  1198. rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7ac767900 rdx=00000000008ab000
  1199. rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  1200. r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  1201. r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
  1202. rip=00007ffdf67c2630 rsp=00000000007efba8 rbp=0000000000000000 ctxflags=0010001b
  1203. cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
  1204. P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
  1205. dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  1206. dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  1207. lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
  1208. 6558.2ef4: kernel32.dll: timestamp 0x38b369c4 (rc=VINF_SUCCESS)
  1209. 6558.2ef4: supR3HardenedWinSetupChildInit: Start child.
  1210. 6558.2ef4: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
  1211. 6558.2ef4: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 17 sleeps
  1212. 6558.2ef4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  1213. 6558.2ef4: *0000000000000000-00000000006affff 0x0001/0x0000 0x0000000
  1214. 6558.2ef4: *00000000006b0000-00000000006cffff 0x0004/0x0004 0x0020000
  1215. 6558.2ef4: *00000000006d0000-00000000006ecfff 0x0002/0x0002 0x0040000
  1216. 6558.2ef4: 00000000006ed000-00000000006effff 0x0001/0x0000 0x0000000
  1217. 6558.2ef4: *00000000006f0000-00000000007eafff 0x0000/0x0004 0x0020000
  1218. 6558.2ef4: 00000000007eb000-00000000007edfff 0x0104/0x0004 0x0020000
  1219. 6558.2ef4: 00000000007ee000-00000000007effff 0x0004/0x0004 0x0020000
  1220. 6558.2ef4: *00000000007f0000-00000000007f3fff 0x0002/0x0002 0x0040000
  1221. 6558.2ef4: 00000000007f4000-00000000007fffff 0x0001/0x0000 0x0000000
  1222. 6558.2ef4: *0000000000800000-00000000008aafff 0x0000/0x0004 0x0020000
  1223. 6558.2ef4: 00000000008ab000-00000000008adfff 0x0004/0x0004 0x0020000
  1224. 6558.2ef4: 00000000008ae000-00000000009fffff 0x0000/0x0004 0x0020000
  1225. 6558.2ef4: *0000000000a00000-0000000000a01fff 0x0004/0x0004 0x0020000
  1226. 6558.2ef4: 0000000000a02000-000000007ffdffff 0x0001/0x0000 0x0000000
  1227. 6558.2ef4: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  1228. 6558.2ef4: 000000007ffe1000-000000007ffeafff 0x0001/0x0000 0x0000000
  1229. 6558.2ef4: *000000007ffeb000-000000007ffebfff 0x0002/0x0002 0x0020000
  1230. 6558.2ef4: 000000007ffec000-00007ff579b7ffff 0x0001/0x0000 0x0000000
  1231. 6558.2ef4: *00007ff579b80000-00007ff579b80fff 0x0020/0x0004 0x0020000 !!
  1232. 6558.2ef4: supHardNtVpFreeOrReplacePrivateExecMemory: Freeing exec mem at 00007ff579b80000 (LB 0x1000, 00007ff579b80000 LB 0x1000)
  1233. 6558.2ef4: 0000000000e49d10/0000: 16 00 20 00 00 00 00 00-10 00 b8 79 f5 7f 00 00 .. ........y....
  1234. 0000000000e49d20/0010: 61 00 74 00 63 00 75 00-66 00 36 00 34 00 2e 00 a.t.c.u.f.6.4...
  1235. 0000000000e49d30/0020: 64 00 6c 00 6c 00 00 00-00 00 00 00 00 00 00 00 d.l.l...........
  1236. 0000000000e49d40/0030: 43 00 3a 00 5c 00 50 00-72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
  1237. 0000000000e49d50/0040: 61 00 6d 00 20 00 46 00-69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
  1238. 0000000000e49d60/0050: 5c 00 42 00 69 00 74 00-64 00 65 00 66 00 65 00 \.B.i.t.d.e.f.e.
  1239. 0000000000e49d70/0060: 6e 00 64 00 65 00 72 00-20 00 41 00 6e 00 74 00 n.d.e.r. .A.n.t.
  1240. 0000000000e49d80/0070: 69 00 76 00 69 00 72 00-75 00 73 00 20 00 46 00 i.v.i.r.u.s. .F.
  1241. 0000000000e49d90/0080: 72 00 65 00 65 00 5c 00-61 00 74 00 63 00 75 00 r.e.e.\.a.t.c.u.
  1242. 0000000000e49da0/0090: 66 00 5c 00 64 00 6c 00-6c 00 73 00 5f 00 32 00 f.\.d.l.l.s._.2.
  1243. 0000000000e49db0/00a0: 36 00 35 00 36 00 39 00-31 00 32 00 36 00 37 00 6.5.6.9.1.2.6.7.
  1244. 0000000000e49dc0/00b0: 30 00 35 00 32 00 36 00-39 00 36 00 34 00 35 00 0.5.2.6.9.6.4.5.
  1245. 0000000000e49dd0/00c0: 34 00 5c 00 00 00 00 00-00 00 00 00 00 00 00 00 4.\.............
  1246. 0000000000e49de0/00d0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1247. 0000000000e49df0/00e0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1248. 0000000000e49e00/00f0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1249. 6558.2ef4: 0000000000e4a110/0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1250. **************** **** <ditto x 2>
  1251. 0000000000e4a140/0030: 16 00 20 00 00 00 00 00-40 04 b8 79 f5 7f 00 00 .. .....@..y....
  1252. 0000000000e4a150/0040: 62 00 64 00 68 00 6b 00-6d 00 36 00 34 00 2e 00 b.d.h.k.m.6.4...
  1253. 0000000000e4a160/0050: 64 00 6c 00 6c 00 00 00-00 00 00 00 00 00 00 00 d.l.l...........
  1254. 0000000000e4a170/0060: 43 00 3a 00 5c 00 50 00-72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
  1255. 0000000000e4a180/0070: 61 00 6d 00 20 00 46 00-69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
  1256. 0000000000e4a190/0080: 5c 00 42 00 69 00 74 00-64 00 65 00 66 00 65 00 \.B.i.t.d.e.f.e.
  1257. 0000000000e4a1a0/0090: 6e 00 64 00 65 00 72 00-20 00 41 00 6e 00 74 00 n.d.e.r. .A.n.t.
  1258. 0000000000e4a1b0/00a0: 69 00 76 00 69 00 72 00-75 00 73 00 20 00 46 00 i.v.i.r.u.s. .F.
  1259. 0000000000e4a1c0/00b0: 72 00 65 00 65 00 5c 00-62 00 64 00 68 00 6b 00 r.e.e.\.b.d.h.k.
  1260. 0000000000e4a1d0/00c0: 6d 00 5c 00 64 00 6c 00-6c 00 73 00 5f 00 32 00 m.\.d.l.l.s._.2.
  1261. 0000000000e4a1e0/00d0: 36 00 35 00 36 00 39 00-31 00 32 00 36 00 37 00 6.5.6.9.1.2.6.7.
  1262. 0000000000e4a1f0/00e0: 30 00 36 00 32 00 37 00-32 00 32 00 31 00 37 00 0.6.2.7.2.2.1.7.
  1263. 0000000000e4a200/00f0: 37 00 5c 00 00 00 00 00-00 00 00 00 00 00 00 00 7.\.............
  1264. 6558.2ef4: 0000000000e4a510/0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1265. **************** **** <ditto x 5>
  1266. 0000000000e4a570/0060: 10 6a 78 f6 fd 7f 00 00-60 d7 80 f6 fd 7f 00 00 .jx.....`.......
  1267. 0000000000e4a580/0070: 48 89 5c 24 10 56 57 41-56 48 81 ec d0 00 00 00 H.\$.VWAVH......
  1268. 0000000000e4a590/0080: 48 83 ec 38 56 57 51 52-41 50 41 51 48 83 ec 40 H..8VWQRAPAQH..@
  1269. 0000000000e4a5a0/0090: 48 b9 ff ff ff ff ff ff-ff ff 48 8b 15 bf ff ff H.........H.....
  1270. 0000000000e4a5b0/00a0: ff 48 89 54 24 38 48 8d-54 24 38 48 c7 44 24 28 .H.T$8H.T$8H.D$(
  1271. 0000000000e4a5c0/00b0: 10 00 00 00 4c 8d 44 24-28 49 c7 c1 04 00 00 00 ....L.D$(I......
  1272. 0000000000e4a5d0/00c0: 48 8d 7c 24 30 48 89 7c-24 20 48 8b 05 97 ff ff H.|$0H.|$ H.....
  1273. 0000000000e4a5e0/00d0: ff ff d0 85 c0 0f 88 00-01 00 00 48 8d 35 8e ff ...........H.5..
  1274. 0000000000e4a5f0/00e0: ff ff 48 8b 3d 77 ff ff-ff 48 c7 c1 10 00 00 00 ..H.=w...H......
  1275. 0000000000e4a600/00f0: fc f3 a4 48 b9 ff ff ff-ff ff ff ff ff 48 8b 15 ...H.........H..
  1276. 6558.2ef4: 0000000000e4a610/0000: 5c ff ff ff 48 89 54 24-38 48 8d 54 24 38 48 c7 \...H.T$8H.T$8H.
  1277. 0000000000e4a620/0010: 44 24 28 10 00 00 00 4c-8d 44 24 28 4c 8b 4c 24 D$(....L.D$(L.L$
  1278. 0000000000e4a630/0020: 30 48 8d 7c 24 30 48 89-7c 24 20 48 8b 05 36 ff 0H.|$0H.|$ H..6.
  1279. 0000000000e4a640/0030: ff ff ff d0 85 c0 0f 88-9f 00 00 00 48 83 c4 40 ............H..@
  1280. 0000000000e4a650/0040: 41 59 41 58 5a 59 5f 5e-48 8b 05 11 ff ff ff 48 AYAXZY_^H......H
  1281. 0000000000e4a660/0050: 83 ec 20 ff d0 48 83 c4-20 85 c0 0f 88 86 00 00 .. ..H.. .......
  1282. 0000000000e4a670/0060: 00 65 48 8b 0c 25 60 00-00 00 ba 00 01 00 02 85 .eH..%`.........
  1283. 0000000000e4a680/0070: 91 bc 00 00 00 75 70 48-8d 0d e2 fa ff ff 48 c7 .....upH......H.
  1284. 0000000000e4a690/0080: c2 00 00 00 00 4c 8d 05-a4 fa ff ff 4c 8d 4c 24 .....L......L.L$
  1285. 0000000000e4a6a0/0090: 20 48 8b 05 c8 fe ff ff-48 83 ec 20 ff d0 48 83 H......H.. ..H.
  1286. 0000000000e4a6b0/00a0: c4 20 85 c0 74 05 48 31-c0 eb 3c 48 8d 0d 7e f6 . ..t.H1..<H..~.
  1287. 0000000000e4a6c0/00b0: ff ff 48 c7 c2 00 00 00-00 4c 8d 05 40 f6 ff ff ..H......L..@...
  1288. 0000000000e4a6d0/00c0: 4c 8d 4c 24 20 48 8b 05-94 fe ff ff 48 83 ec 20 L.L$ H......H..
  1289. 0000000000e4a6e0/00d0: ff d0 48 83 c4 20 48 31-c0 eb 0c 48 83 c4 40 41 ..H.. H1...H..@A
  1290. 0000000000e4a6f0/00e0: 59 41 58 5a 59 5f 5e 48-83 c4 38 c3 00 00 00 00 YAXZY_^H..8.....
  1291. 0000000000e4a700/00f0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
  1292. 6558.2ef4: supHardNtVpFreeOrReplacePrivateExecMemory: Free attempt #1 succeeded: 0x0 [00007ff579b80000/00007ff579b80000 LB 0/0x1000]
  1293. 6558.2ef4: supHardNtVpFreeOrReplacePrivateExecMemory: QVM after free 0: [0000000000000000]/00007ff579b80000 LB 0x10000 s=0x10000 ap=0x0 rp=0x00000000000001
  1294. 6558.2ef4: 00007ff579b81000-00007ff579b8ffff 0x0001/0x0000 0x0000000
  1295. 6558.2ef4: *00007ff579b90000-00007ff579b90fff 0x0002/0x0002 0x0040000
  1296. 6558.2ef4: 00007ff579b91000-00007ff579b9ffff 0x0001/0x0000 0x0000000
  1297. 6558.2ef4: *00007ff579ba0000-00007ff579bc2fff 0x0002/0x0002 0x0040000
  1298. 6558.2ef4: 00007ff579bc3000-00007ff7ac75ffff 0x0001/0x0000 0x0000000
  1299. 6558.2ef4: *00007ff7ac760000-00007ff7ac760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1300. 6558.2ef4: 00007ff7ac761000-00007ff7ac7d7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1301. 6558.2ef4: 00007ff7ac7d8000-00007ff7ac7d8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1302. 6558.2ef4: 00007ff7ac7d9000-00007ff7ac821fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1303. 6558.2ef4: 00007ff7ac822000-00007ff7ac822fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1304. 6558.2ef4: 00007ff7ac823000-00007ff7ac823fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1305. 6558.2ef4: 00007ff7ac824000-00007ff7ac828fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1306. 6558.2ef4: 00007ff7ac829000-00007ff7ac829fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1307. 6558.2ef4: 00007ff7ac82a000-00007ff7ac82afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1308. 6558.2ef4: 00007ff7ac82b000-00007ff7ac82efff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1309. 6558.2ef4: 00007ff7ac82f000-00007ff7ac877fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1310. 6558.2ef4: 00007ff7ac878000-00007ffdf676ffff 0x0001/0x0000 0x0000000
  1311. 6558.2ef4: *00007ffdf6770000-00007ffdf6770fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1312. 6558.2ef4: 00007ffdf6771000-00007ffdf688bfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1313. 6558.2ef4: 00007ffdf688c000-00007ffdf68d3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1314. 6558.2ef4: 00007ffdf68d4000-00007ffdf68dffff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1315. 6558.2ef4: 00007ffdf68e0000-00007ffdf68eefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1316. 6558.2ef4: 00007ffdf68ef000-00007ffdf68effff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1317. 6558.2ef4: 00007ffdf68f0000-00007ffdf68f2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1318. 6558.2ef4: 00007ffdf68f3000-00007ffdf6964fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1319. 6558.2ef4: 00007ffdf6965000-00007ffffffeffff 0x0001/0x0000 0x0000000
  1320. 6558.2ef4: VirtualBoxVM.exe: timestamp 0x619bb44c (rc=VINF_SUCCESS)
  1321. 6558.2ef4: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  1322. 6558.2ef4: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  1323. 6558.2ef4: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
  1324. 6558.2ef4: ntdll.dll: Differences in section #1 (.text) between file and memory:
  1325. 6558.2ef4: 00007ffdf6786a11 / 0x0016a11: 89 != b8
  1326. 6558.2ef4: 00007ffdf6786a12 / 0x0016a12: 5c != 80
  1327. 6558.2ef4: 00007ffdf6786a13 / 0x0016a13: 24 != 08
  1328. 6558.2ef4: 00007ffdf6786a14 / 0x0016a14: 10 != b8
  1329. 6558.2ef4: 00007ffdf6786a15 / 0x0016a15: 56 != 79
  1330. 6558.2ef4: 00007ffdf6786a16 / 0x0016a16: 57 != f5
  1331. 6558.2ef4: 00007ffdf6786a17 / 0x0016a17: 41 != 7f
  1332. 6558.2ef4: 00007ffdf6786a18 / 0x0016a18: 56 != 00
  1333. 6558.2ef4: 00007ffdf6786a19 / 0x0016a19: 48 != 00
  1334. 6558.2ef4: 00007ffdf6786a1a / 0x0016a1a: 81 != ff
  1335. 6558.2ef4: 00007ffdf6786a1b / 0x0016a1b: ec != e0
  1336. 6558.2ef4: Restored 0x2000 bytes of original file content at 00007ffdf6785000
  1337. 6558.2ef4: supR3HardNtChildPurify: cFixes=2 g_fSupAdversaries=0x80000000
  1338. 6558.2ef4: supR3HardNtChildPurify: Startup delay kludge #1/1: 513 ms, 33 sleeps
  1339. 6558.2ef4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  1340. 6558.2ef4: *0000000000000000-00000000006affff 0x0001/0x0000 0x0000000
  1341. 6558.2ef4: *00000000006b0000-00000000006cffff 0x0004/0x0004 0x0020000
  1342. 6558.2ef4: *00000000006d0000-00000000006ecfff 0x0002/0x0002 0x0040000
  1343. 6558.2ef4: 00000000006ed000-00000000006effff 0x0001/0x0000 0x0000000
  1344. 6558.2ef4: *00000000006f0000-00000000007eafff 0x0000/0x0004 0x0020000
  1345. 6558.2ef4: 00000000007eb000-00000000007edfff 0x0104/0x0004 0x0020000
  1346. 6558.2ef4: 00000000007ee000-00000000007effff 0x0004/0x0004 0x0020000
  1347. 6558.2ef4: *00000000007f0000-00000000007f3fff 0x0002/0x0002 0x0040000
  1348. 6558.2ef4: 00000000007f4000-00000000007fffff 0x0001/0x0000 0x0000000
  1349. 6558.2ef4: *0000000000800000-00000000008aafff 0x0000/0x0004 0x0020000
  1350. 6558.2ef4: 00000000008ab000-00000000008adfff 0x0004/0x0004 0x0020000
  1351. 6558.2ef4: 00000000008ae000-00000000009fffff 0x0000/0x0004 0x0020000
  1352. 6558.2ef4: *0000000000a00000-0000000000a01fff 0x0004/0x0004 0x0020000
  1353. 6558.2ef4: 0000000000a02000-000000007ffdffff 0x0001/0x0000 0x0000000
  1354. 6558.2ef4: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  1355. 6558.2ef4: 000000007ffe1000-000000007ffeafff 0x0001/0x0000 0x0000000
  1356. 6558.2ef4: *000000007ffeb000-000000007ffebfff 0x0002/0x0002 0x0020000
  1357. 6558.2ef4: 000000007ffec000-00007ff579b8ffff 0x0001/0x0000 0x0000000
  1358. 6558.2ef4: *00007ff579b90000-00007ff579b90fff 0x0002/0x0002 0x0040000
  1359. 6558.2ef4: 00007ff579b91000-00007ff579b9ffff 0x0001/0x0000 0x0000000
  1360. 6558.2ef4: *00007ff579ba0000-00007ff579bc2fff 0x0002/0x0002 0x0040000
  1361. 6558.2ef4: 00007ff579bc3000-00007ff7ac75ffff 0x0001/0x0000 0x0000000
  1362. 6558.2ef4: *00007ff7ac760000-00007ff7ac760fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1363. 6558.2ef4: 00007ff7ac761000-00007ff7ac7d7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1364. 6558.2ef4: 00007ff7ac7d8000-00007ff7ac7d8fff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1365. 6558.2ef4: 00007ff7ac7d9000-00007ff7ac821fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1366. 6558.2ef4: 00007ff7ac822000-00007ff7ac82efff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1367. 6558.2ef4: 00007ff7ac82f000-00007ff7ac877fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1368. 6558.2ef4: 00007ff7ac878000-00007ffdf676ffff 0x0001/0x0000 0x0000000
  1369. 6558.2ef4: *00007ffdf6770000-00007ffdf6770fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1370. 6558.2ef4: 00007ffdf6771000-00007ffdf688bfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1371. 6558.2ef4: 00007ffdf688c000-00007ffdf68d3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1372. 6558.2ef4: 00007ffdf68d4000-00007ffdf68d7fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1373. 6558.2ef4: 00007ffdf68d8000-00007ffdf68dffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1374. 6558.2ef4: 00007ffdf68e0000-00007ffdf68eefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1375. 6558.2ef4: 00007ffdf68ef000-00007ffdf68effff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1376. 6558.2ef4: 00007ffdf68f0000-00007ffdf68f2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1377. 6558.2ef4: 00007ffdf68f3000-00007ffdf6964fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
  1378. 6558.2ef4: 00007ffdf6965000-00007ffffffeffff 0x0001/0x0000 0x0000000
  1379. 6558.2ef4: supR3HardNtChildPurify: Done after 813 ms and 2 fixes (loop #1).
  1380. 3e68.3760: Log file opened: 6.1.30r148432 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa04a6400
  1381. 6558.2ef4: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000700000 LB 0x400000)
  1382. 3e68.3760: supR3HardenedVmProcessInit: uNtDllAddr=00007ffdf6770000 g_uNtVerCombined=0xa04a6400 (stack ~00000000007ef638)
  1383. 6558.2ef4: supR3HardNtEnableThreadCreationEx:
  1384. 3e68.3760: ntdll.dll: timestamp 0xa280d1d6 (rc=VINF_SUCCESS)
  1385. 3e68.3760: New simple heap: #1 0000000000b10000 LB 0x400000 (for 2052096 allocation)
  1386. 3e68.3760: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1387. 3e68.3760: System32: \Device\HarddiskVolume3\Windows\System32
  1388. 3e68.3760: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
  1389. 3e68.3760: KnownDllPath: C:\WINDOWS\System32
  1390. 3e68.3760: supR3HardenedVmProcessInit: Opening vboxdrv...
  1391. 3e68.3760: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  1392. 3e68.3760: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  1393. 3e68.3760: Registered Dll notification callback with NTDLL.
  1394. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
  1395. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  1396. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
  1397. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3fe0000 LB 0x002c8000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
  1398. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
  1399. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
  1400. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf63f0000 LB 0x000be000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
  1401. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  1402. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\KERNEL32.DLL'
  1403. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ff7ac760000 LB 0x00118000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
  1404. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  1405. 3e68.3760: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  1406. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  1407. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  1408. 3e68.3760: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffdf67e4b00 pvNtTerminateThread=00007ffdf680d7c0
  1409. 6558.2ef4: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 92 ms.
  1410. 3e68.3760: \SystemRoot\System32\ntdll.dll:
  1411. 3e68.3760: CreationTime: 2021-10-06T13:39:54.967473200Z
  1412. 3e68.3760: LastWriteTime: 2021-10-06T13:39:55.014335100Z
  1413. 3e68.3760: ChangeTime: 2021-12-17T09:52:47.850888900Z
  1414. 3e68.3760: FileAttributes: 0x20
  1415. 3e68.3760: Size: 0x1ee520
  1416. 3e68.3760: NT Headers: 0xe8
  1417. 3e68.3760: Timestamp: 0xa280d1d6
  1418. 3e68.3760: Machine: 0x8664 - amd64
  1419. 3e68.3760: Timestamp: 0xa280d1d6
  1420. 3e68.3760: Image Version: 10.0
  1421. 3e68.3760: SizeOfImage: 0x1f5000 (2052096)
  1422. 3e68.3760: Resource Dir: 0x184000 LB 0x6fdc8
  1423. 3e68.3760: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1424. 3e68.3760: [Raw version resource data: 0x1840f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  1425. 3e68.3760: ProductName: Microsoft® Windows® Operating System
  1426. 3e68.3760: ProductVersion: 10.0.19041.1288
  1427. 3e68.3760: FileVersion: 10.0.19041.1288 (WinBuild.160101.0800)
  1428. 3e68.3760: FileDescription: NT Layer DLL
  1429. 3e68.3760: \SystemRoot\System32\kernel32.dll:
  1430. 3e68.3760: CreationTime: 2021-12-02T15:03:52.492099300Z
  1431. 3e68.3760: LastWriteTime: 2021-12-02T15:03:52.505102200Z
  1432. 3e68.3760: ChangeTime: 2021-12-17T09:52:47.655061900Z
  1433. 3e68.3760: FileAttributes: 0x20
  1434. 3e68.3760: Size: 0xbc058
  1435. 3e68.3760: NT Headers: 0xe8
  1436. 3e68.3760: Timestamp: 0x38b369c4
  1437. 3e68.3760: Machine: 0x8664 - amd64
  1438. 3e68.3760: Timestamp: 0x38b369c4
  1439. 3e68.3760: Image Version: 10.0
  1440. 3e68.3760: SizeOfImage: 0xbe000 (778240)
  1441. 3e68.3760: Resource Dir: 0xbc000 LB 0x520
  1442. 3e68.3760: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1443. 3e68.3760: [Raw version resource data: 0xbc0b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  1444. 3e68.3760: ProductName: Microsoft® Windows® Operating System
  1445. 3e68.3760: ProductVersion: 10.0.19041.1348
  1446. 3e68.3760: FileVersion: 10.0.19041.1348 (WinBuild.160101.0800)
  1447. 3e68.3760: FileDescription: Windows NT BASE API Client DLL
  1448. 3e68.3760: \SystemRoot\System32\KernelBase.dll:
  1449. 3e68.3760: CreationTime: 2021-12-17T09:52:07.022047900Z
  1450. 3e68.3760: LastWriteTime: 2021-12-17T09:52:07.089062400Z
  1451. 3e68.3760: ChangeTime: 2021-12-18T17:56:07.323012400Z
  1452. 3e68.3760: FileAttributes: 0x20
  1453. 3e68.3760: Size: 0x2c9168
  1454. 3e68.3760: NT Headers: 0xf0
  1455. 3e68.3760: Timestamp: 0xb9a844a
  1456. 3e68.3760: Machine: 0x8664 - amd64
  1457. 3e68.3760: Timestamp: 0xb9a844a
  1458. 3e68.3760: Image Version: 10.0
  1459. 3e68.3760: SizeOfImage: 0x2c8000 (2916352)
  1460. 3e68.3760: Resource Dir: 0x29f000 LB 0x548
  1461. 3e68.3760: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1462. 3e68.3760: [Raw version resource data: 0x29f0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
  1463. 3e68.3760: ProductName: Microsoft® Windows® Operating System
  1464. 3e68.3760: ProductVersion: 10.0.19041.1387
  1465. 3e68.3760: FileVersion: 10.0.19041.1387 (WinBuild.160101.0800)
  1466. 3e68.3760: FileDescription: Windows NT BASE API Client DLL
  1467. 3e68.3760: \SystemRoot\System32\apisetschema.dll:
  1468. 3e68.3760: CreationTime: 2019-12-07T09:08:13.518339400Z
  1469. 3e68.3760: LastWriteTime: 2019-12-07T09:08:13.518339400Z
  1470. 3e68.3760: ChangeTime: 2021-12-17T09:52:47.633058800Z
  1471. 3e68.3760: FileAttributes: 0x20
  1472. 3e68.3760: Size: 0x1f538
  1473. 3e68.3760: NT Headers: 0xd0
  1474. 3e68.3760: Timestamp: 0x31288ce0
  1475. 3e68.3760: Machine: 0x8664 - amd64
  1476. 3e68.3760: Timestamp: 0x31288ce0
  1477. 3e68.3760: Image Version: 10.0
  1478. 3e68.3760: SizeOfImage: 0x20000 (131072)
  1479. 3e68.3760: Resource Dir: 0x1f000 LB 0x408
  1480. 3e68.3760: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  1481. 3e68.3760: [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
  1482. 3e68.3760: ProductName: Microsoft® Windows® Operating System
  1483. 3e68.3760: ProductVersion: 10.0.19041.1
  1484. 3e68.3760: FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
  1485. 3e68.3760: FileDescription: ApiSet Schema DLL
  1486. 3e68.3760: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  1487. 3e68.3760: supR3HardenedWinFindAdversaries: 0x0
  1488. 3e68.3760: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1489. 3e68.3760: Calling main()
  1490. 3e68.3760: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
  1491. 3e68.3760: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
  1492. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
  1493. 3e68.3760: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
  1494. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
  1495. 3e68.3760: SUPR3HardenedMain: Final process, opening VBoxDrv...
  1496. 3e68.3760: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000b10000 LB 0x400000)
  1497. 3e68.3760: supR3HardNtEnableThreadCreationEx:
  1498. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll: Signature #1/2: info status: 24202
  1499. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  1500. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  1501. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1502. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  1503. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdec7b0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  1504. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  1505. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  1506. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1507. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdec7b0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  1508. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  1509. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1510. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdec7b0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  1511. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdec7b0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  1512. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1513. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1514. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wintrust.dll)
  1515. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wintrust.dll
  1516. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1517. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1518. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
  1519. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1520. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1521. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1522. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcrt.dll)
  1523. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  1524. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1525. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf6350000 LB 0x0009e000 C:\WINDOWS\System32\msvcrt.dll [fFlags=0x0]
  1526. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1527. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf5080000 LB 0x0012a000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
  1528. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1529. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf42e0000 LB 0x00060000 C:\WINDOWS\System32\Wintrust.dll [fFlags=0x0]
  1530. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  1531. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4470000 LB 0x00100000 C:\WINDOWS\System32\ucrtbase.dll [fFlags=0x0]
  1532. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll)
  1533. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ucrtbase.dll
  1534. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4570000 LB 0x00156000 C:\WINDOWS\System32\CRYPT32.dll [fFlags=0x0]
  1535. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\crypt32.dll)
  1536. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1537. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1538. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1539. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-synch-l1-2-0'
  1540. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1541. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1542. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-fibers-l1-1-1'
  1543. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  1544. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1545. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-fibers-l1-1-1'
  1546. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  1547. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1548. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-synch-l1-2-0'
  1549. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  1550. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1551. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-l1-2-1'
  1552. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msasn1.dll)
  1553. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msasn1.dll
  1554. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3610000 LB 0x00012000 C:\WINDOWS\SYSTEM32\MSASN1.dll [fFlags=0x0]
  1555. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  1556. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf42e0000 'C:\WINDOWS\system32\Wintrust.dll'
  1557. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcrypt.dll)
  1558. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  1559. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  1560. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4780000 LB 0x00027000 C:\WINDOWS\System32\bcrypt.dll [fFlags=0x0]
  1561. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1562. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4780000 'C:\WINDOWS\system32\bcrypt.dll'
  1563. 3e68.3760: bcrypt.dll loaded at 00007ffdf4780000, BCryptOpenAlgorithmProvider at 00007ffdf47851e0, preloading providers:
  1564. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll)
  1565. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  1566. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1567. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4340000 LB 0x00082000 C:\WINDOWS\System32\bcryptprimitives.dll [fFlags=0x0]
  1568. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  1569. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4340000 'C:\WINDOWS\system32\bcryptprimitives.dll'
  1570. 3e68.3760: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=0000000000fffb90)
  1571. 3e68.3760: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=0000000001000a20)
  1572. 3e68.3760: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=0000000001000d40)
  1573. 3e68.3760: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=0000000001001060)
  1574. 3e68.3760: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=0000000001001380)
  1575. 3e68.3760: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000010016a0)
  1576. 3e68.3760: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000010019c0)
  1577. 3e68.3760: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=0000000001001ce0)
  1578. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptsp.dll)
  1579. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptsp.dll
  1580. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3b90000 LB 0x00018000 C:\WINDOWS\SYSTEM32\CRYPTSP.dll [fFlags=0x0]
  1581. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1582. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
  1583. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rsaenh.dll)
  1584. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  1585. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1586. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1587. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1588. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1589. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1590. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf2880000 LB 0x00034000 C:\WINDOWS\system32\rsaenh.dll [fFlags=0x0]
  1591. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1592. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1593. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptbase.dll)
  1594. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptbase.dll
  1595. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf31b0000 LB 0x0000c000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
  1596. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  1597. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  1598. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1599. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\kernel32.dll'
  1600. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  1601. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1602. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf42e0000 'C:\WINDOWS\System32\WINTRUST.DLL'
  1603. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1604. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1605. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\CRYPT32.dll'
  1606. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf51b0000 LB 0x0001d000 C:\WINDOWS\System32\imagehlp.dll [fFlags=0x0]
  1607. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imagehlp.dll)
  1608. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imagehlp.dll
  1609. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1610. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1611. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1612. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4910000 LB 0x0009b000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
  1613. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
  1614. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
  1615. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
  1616. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1617. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  1618. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gpapi.dll)
  1619. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gpapi.dll
  1620. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf1920000 LB 0x00023000 C:\WINDOWS\SYSTEM32\gpapi.dll [fFlags=0x0]
  1621. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1622. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\profapi.dll)
  1623. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\profapi.dll
  1624. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3dc0000 LB 0x0001f000 C:\WINDOWS\SYSTEM32\profapi.dll [fFlags=0x0]
  1625. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1626. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1627. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
  1628. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptnet.dll)
  1629. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptnet.dll
  1630. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  1631. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  1632. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1633. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1634. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1635. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1636. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1637. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1638. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1639. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1640. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1641. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1642. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1643. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1644. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1645. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1646. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1647. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdeac20000 LB 0x00031000 C:\WINDOWS\System32\cryptnet.dll [fFlags=0x0]
  1648. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1649. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1650. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1651. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1652. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1653. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1654. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1655. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1656. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1657. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1658. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1659. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1660. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1661. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1662. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1663. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1664. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1665. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
  1666. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1667. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1668. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1669. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1670. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1671. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1672. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1673. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1674. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1675. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1676. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1677. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\WINDOWS\System32\cryptnet.dll'
  1678. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1679. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeac20000 'C:\Windows\System32\cryptnet.dll'
  1680. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf5310000 LB 0x000ac000 C:\WINDOWS\System32\advapi32.dll [fFlags=0x0]
  1681. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1682. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
  1683. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
  1684. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\advapi32.dll)
  1685. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  1686. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1687. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1688. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1689. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1690. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
  1691. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume3\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
  1692. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  1693. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1694. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1695. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1696. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1697. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1698. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1699. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1700. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1701. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  1702. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: New context 0000000001077710
  1703. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  1704. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CF5EACF36F78DD76A9C15BF564DC1094C86C4B18
  1705. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1706. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1707. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5080000 'C:\WINDOWS\System32\rpcrt4.dll'
  1708. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1709. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1710. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1711. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1712. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1713. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1714. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.1288.cat'; file='\SystemRoot\System32\ntdll.dll'
  1715. 3e68.3760: g_pfnWinVerifyTrust=00007ffdf42e1da0
  1716. 3e68.3760: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  1717. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1718. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1719. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1720. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1721. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1722. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1723. 3e68.3760: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\crypt32.dll'
  1724. 3e68.3760: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  1725. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1726. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1727. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1728. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1729. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1730. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1731. 3e68.3760: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\wintrust.dll'
  1732. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1733. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1734. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1735. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1736. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1737. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1738. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\advapi32.dll'
  1739. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1740. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1741. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1742. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
  1743. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1744. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1745. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1746. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\profapi.dll'
  1747. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1748. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1749. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1750. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gpapi.dll'
  1751. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1752. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1753. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1754. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\sechost.dll'
  1755. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1756. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1757. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1758. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imagehlp.dll'
  1759. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1760. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1761. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1762. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptbase.dll'
  1763. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1764. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1765. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1766. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rsaenh.dll'
  1767. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  1768. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1769. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1770. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  1771. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1772. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1773. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptsp.dll'
  1774. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1775. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1776. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll'
  1777. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1778. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1779. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll'
  1780. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1781. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1782. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msasn1.dll'
  1783. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1784. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1785. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll'
  1786. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1787. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1788. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll'
  1789. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1790. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1791. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll'
  1792. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1793. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1794. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1795. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe'
  1796. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1797. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1798. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\KernelBase.dll'
  1799. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1800. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1801. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel32.dll'
  1802. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\system32\crypt32.dll'
  1803. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1804. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1805. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  1806. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1807. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
  1808. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1809. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1810. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
  1811. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
  1812. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1813. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1814. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
  1815. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x43323b06d8e78a8c CN=Bitdefender Personal CA.avfree000000, OU=IDS, O=Bitdefender, C=US
  1816. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root Certificate Authority 2014
  1817. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x2ca429a5c4c6a700 C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA
  1818. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1819. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  1820. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
  1821. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xbbde687390e6bf00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4
  1822. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  1823. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1824. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1825. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  1826. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x3714f47324e8ad00 C=US, O=Internet Security Research Group, CN=ISRG Root X1
  1827. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xd944bca189a00 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
  1828. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
  1829. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
  1830. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1831. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1832. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1833. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1834. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1835. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
  1836. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xbebef0d2217f0bfb C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3
  1837. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1838. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1839. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
  1840. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1841. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x73e85f1bda5faa00 C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2
  1842. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
  1843. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1844. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1845. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
  1846. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
  1847. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1848. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
  1849. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1850. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xdc1801b225aea100 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3
  1851. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  1852. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1853. 3e68.3760: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1854. 3e68.3760: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=51
  1855. 3e68.3760: SUPR3HardenedMain: Load Runtime...
  1856. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll: Signature #1/2: info status: 24202
  1857. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1858. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1859. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1860. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  1861. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1862. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  1863. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1864. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1865. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1866. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1867. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  1868. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1869. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ws2_32.dll) WinVerifyTrust
  1870. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1871. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1872. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1873. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1874. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1875. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1876. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll: Signature #1/2: info status: 24202
  1877. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1878. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1879. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  1880. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1881. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1882. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  1883. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1884. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1885. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1886. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll: Signature #1/2: info status: 24202
  1887. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1888. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1889. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll: Signature #1/2: info status: 24202
  1890. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1891. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll)
  1892. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  1893. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  1894. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  1895. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  1896. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1897. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  1898. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1899. 3e68.3760: supR3HardenedDllNotificationCallback: load 000000005d4d0000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1900. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
  1901. 3e68.3760: supR3HardenedDllNotificationCallback: load 000000005c950000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1902. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  1903. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf53c0000 LB 0x0006b000 C:\WINDOWS\System32\WS2_32.dll [fFlags=0x0]
  1904. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  1905. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffd8c4a0000 LB 0x005eb000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1906. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1907. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1908. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1909. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1910. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1911. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1912. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1913. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1914. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1915. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1916. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1917. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1918. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1919. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1920. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1921. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1922. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1923. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1924. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1925. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1926. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1927. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1928. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1929. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1930. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1931. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1932. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1933. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1934. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1935. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1936. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1937. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1938. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1939. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1940. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1941. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1942. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1943. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1944. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1945. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1946. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1947. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1948. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1949. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1950. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1951. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1952. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1953. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1954. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1955. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1956. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1957. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1958. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1959. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1960. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1961. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1962. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1963. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1964. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1965. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1966. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1967. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1968. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1969. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1970. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1971. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1972. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1973. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1974. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1975. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1976. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1977. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1978. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1979. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1980. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1981. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1982. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1983. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1984. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1985. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1986. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1987. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  1988. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1989. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1990. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1991. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1992. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1993. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1994. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1995. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1996. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  1997. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  1998. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1999. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2000. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2001. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2002. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2003. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2004. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2005. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2006. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2007. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2008. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2009. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2010. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2011. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2012. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2013. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2014. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2015. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2016. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2017. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2018. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2019. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2020. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2021. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2022. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2023. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2024. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2025. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2026. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2027. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2028. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2029. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2030. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2031. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2032. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2033. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2034. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2035. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2036. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2037. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2038. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2039. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2040. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2041. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2042. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2043. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2044. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2045. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2046. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2047. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2048. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2049. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2050. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2051. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2052. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2053. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2054. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2055. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2056. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2057. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2058. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2059. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2060. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2061. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2062. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2063. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2064. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2065. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2066. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2067. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2068. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
  2069. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2070. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2071. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2072. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2073. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2074. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2075. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2076. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2077. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2078. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2079. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2080. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2081. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
  2082. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
  2083. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8c4a0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  2084. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2085. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'
  2086. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll
  2087. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2088. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf42e0000 'C:\WINDOWS\system32\Wintrust.dll'
  2089. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  2090. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2091. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2092. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2093. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2094. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2095. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\system32\crypt32.dll'
  2096. 3e68.3760: SUPR3HardenedMain: Load TrustedMain...
  2097. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll: Signature #1/2: info status: 24202
  2098. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2099. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  2100. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'uicommon.dll'.
  2101. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  2102. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcp100.dll'.
  2103. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcr100.dll'.
  2104. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5corevbox.dll'.
  2105. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5guivbox.dll'.
  2106. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5widgetsvbox.dll'.
  2107. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  2108. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  2109. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'ole32.dll'.
  2110. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'oleaut32.dll'.
  2111. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'winmm.dll'.
  2112. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll) WinVerifyTrust
  2113. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  2114. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2115. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2116. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2117. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2118. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  2119. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmm.dll) WinVerifyTrust
  2120. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2121. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2122. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2123. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2124. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2125. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  2126. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2127. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2128. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  2129. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
  2130. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
  2131. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleaut32.dll) WinVerifyTrust
  2132. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2133. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2134. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2135. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2136. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2137. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  2138. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2139. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2140. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2141. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  2142. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\combase.dll)
  2143. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\combase.dll
  2144. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2145. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2146. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2147. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll)
  2148. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  2149. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2150. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2151. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2152. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  2153. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2154. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2155. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
  2156. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'gdi32.dll'.
  2157. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'user32.dll'.
  2158. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #51 'combase.dll'.
  2159. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ole32.dll) WinVerifyTrust
  2160. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2161. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2162. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2163. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2164. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2165. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [lacks WinVerifyTrust]
  2166. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2167. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2168. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2169. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  2170. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
  2171. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\user32.dll)
  2172. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\user32.dll
  2173. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2174. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2175. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2176. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'win32u.dll'.
  2177. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32.dll)
  2178. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  2179. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2180. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2181. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2182. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2183. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2184. 3e68.3760: '\Device\HarddiskVolume3\Windows\System32\win32u.dll' has no imports
  2185. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\win32u.dll)
  2186. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\win32u.dll
  2187. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2188. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2189. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2190. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2191. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2192. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  2193. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2194. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2195. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  2196. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
  2197. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\user32.dll) WinVerifyTrust
  2198. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  2199. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  2200. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll: Signature #1/2: info status: 24202
  2201. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2202. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2203. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2204. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2205. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2206. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
  2207. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2208. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  2209. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  2210. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  2211. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  2212. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  2213. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2214. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2215. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2216. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll: Signature #1/2: info status: 24202
  2217. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2218. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2219. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2220. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2221. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2222. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll: Signature #1/2: info status: 24202
  2223. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'.
  2224. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  2225. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  2226. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  2227. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  2228. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  2229. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  2230. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  2231. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  2232. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll)
  2233. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2234. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2235. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2236. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll: Signature #1/2: info status: 24202
  2237. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'.
  2238. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  2239. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  2240. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2241. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2242. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  2243. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  2244. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  2245. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll)
  2246. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2247. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2248. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2249. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll: Signature #1/2: info status: 24202
  2250. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2251. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2252. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  2253. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  2254. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  2255. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  2256. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  2257. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  2258. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll)
  2259. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2260. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2261. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2262. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2263. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2264. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2265. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2266. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2267. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2268. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2269. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  2270. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #72 'user32.dll'.
  2271. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #74 'gdi32.dll'.
  2272. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shell32.dll)
  2273. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shell32.dll
  2274. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2275. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2276. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  2277. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2278. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2279. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  2280. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2281. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2282. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2283. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2284. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2285. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2286. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2287. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2288. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2289. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2290. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2291. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2292. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2293. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2294. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  2295. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2296. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2297. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2298. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2299. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2300. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2301. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2302. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2303. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'.
  2304. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2305. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  2306. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2307. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  2308. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'glu32.dll'.
  2309. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\opengl32.dll)
  2310. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  2311. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2312. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2313. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2314. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2315. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2316. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2317. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2318. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2319. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2320. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  2321. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  2322. 3e68.3760: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2323. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mpr.dll)
  2324. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mpr.dll
  2325. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2326. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2327. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  2328. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2329. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2330. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  2331. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2332. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2333. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2334. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2335. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2336. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [lacks WinVerifyTrust]
  2337. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2338. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2339. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2340. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  2341. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  2342. 3e68.3760: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2343. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2344. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  2345. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'opengl32.dll'.
  2346. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\glu32.dll)
  2347. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\glu32.dll
  2348. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2349. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2350. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2351. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2352. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2353. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2354. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2355. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2356. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  2357. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2358. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2359. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  2360. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2361. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2362. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2363. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2364. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2365. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2366. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2367. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2368. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [lacks WinVerifyTrust]
  2369. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2370. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2371. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
  2372. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2373. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2374. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2375. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2376. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2377. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  2378. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2379. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2380. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  2381. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  2382. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  2383. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  2384. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  2385. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  2386. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  2387. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2388. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2389. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [redoing WinVerifyTrust]
  2390. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2391. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2392. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2393. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2394. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2395. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2396. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2397. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2398. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [lacks WinVerifyTrust]
  2399. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2400. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2401. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
  2402. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2403. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2404. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
  2405. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2406. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2407. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2408. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2409. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2410. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  2411. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2412. 3e68.3760: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'
  2413. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2414. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2415. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
  2416. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2417. 3e68.3760: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'
  2418. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2419. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2420. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  2421. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2422. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2423. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  2424. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2425. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2426. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uicommon.dll'...
  2427. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\uicommon.dll' [rcNtRedir=0xc0150008]
  2428. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll: Signature #1/2: info status: 24202
  2429. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2430. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
  2431. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcr100.dll'.
  2432. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  2433. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  2434. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5widgetsvbox.dll'.
  2435. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2436. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  2437. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ole32.dll'.
  2438. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  2439. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
  2440. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll) WinVerifyTrust
  2441. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
  2442. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2443. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2444. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [redoing WinVerifyTrust]
  2445. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000440 pwszName=\Device\HarddiskVolume3\Windows\System32\opengl32.dll
  2446. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  2447. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  2448. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8E7659A85CD9E1DD85A2EDD240E0AFC0D2340903
  2449. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2450. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2451. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2452. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2453. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2454. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2455. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2456. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2457. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2458. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2459. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  2460. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2461. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2462. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
  2463. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2464. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2465. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
  2466. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2467. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2468. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2469. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2470. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2471. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2472. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2473. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2474. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  2475. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  2476. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2477. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2478. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
  2479. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2480. 3e68.3760: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
  2481. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
  2482. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  2483. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  2484. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
  2485. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2486. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2487. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
  2488. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2489. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2490. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  2491. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  2492. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf42b0000 LB 0x00022000 C:\WINDOWS\System32\win32u.dll [fFlags=0x0]
  2493. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
  2494. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf43d0000 LB 0x0009d000 C:\WINDOWS\System32\msvcp_win.dll [fFlags=0x0]
  2495. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
  2496. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3ed0000 LB 0x0010d000 C:\WINDOWS\System32\gdi32full.dll [fFlags=0x0]
  2497. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  2498. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'gdi32.dll'.
  2499. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
  2500. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'win32u.dll'.
  2501. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32full.dll)
  2502. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32full.dll
  2503. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf6320000 LB 0x0002b000 C:\WINDOWS\System32\GDI32.dll [fFlags=0x0]
  2504. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
  2505. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf6170000 LB 0x001a1000 C:\WINDOWS\System32\USER32.dll [fFlags=0x0]
  2506. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [avoiding WinVerifyTrust]
  2507. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf5430000 LB 0x00355000 C:\WINDOWS\System32\combase.dll [fFlags=0x0]
  2508. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [avoiding WinVerifyTrust]
  2509. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffda2f10000 LB 0x0002c000 C:\WINDOWS\SYSTEM32\GLU32.dll [fFlags=0x0]
  2510. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
  2511. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffd94df0000 LB 0x00125000 C:\WINDOWS\SYSTEM32\OPENGL32.dll [fFlags=0x0]
  2512. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
  2513. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf5790000 LB 0x00744000 C:\WINDOWS\System32\SHELL32.dll [fFlags=0x0]
  2514. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [avoiding WinVerifyTrust]
  2515. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf47e0000 LB 0x0012a000 C:\WINDOWS\System32\ole32.dll [fFlags=0x0]
  2516. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2517. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdd43b0000 LB 0x0001d000 C:\WINDOWS\SYSTEM32\MPR.dll [fFlags=0x0]
  2518. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
  2519. 3e68.3760: supR3HardenedDllNotificationCallback: load 000000005cf60000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  2520. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2521. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffd8bea0000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  2522. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2523. 3e68.3760: supR3HardenedDllNotificationCallback: load 000000005c9f0000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  2524. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
  2525. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf64b0000 LB 0x000cd000 C:\WINDOWS\System32\OLEAUT32.dll [fFlags=0x0]
  2526. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2527. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffd8ca90000 LB 0x0231e000 C:\Program Files\Oracle\VirtualBox\UICommon.dll [fFlags=0x0]
  2528. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
  2529. 3e68.3760: supR3HardenedDllNotificationCallback: load 000000005c8a0000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  2530. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2531. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf0d80000 LB 0x00027000 C:\WINDOWS\SYSTEM32\WINMM.dll [fFlags=0x0]
  2532. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2533. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffda4f80000 LB 0x001c8000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll [fFlags=0x0]
  2534. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
  2535. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2536. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2537. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2538. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2539. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2540. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2541. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2542. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2543. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2544. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2545. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2546. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2547. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2548. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2549. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2550. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2551. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2552. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2553. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2554. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2555. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  2556. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2557. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2558. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  2559. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2560. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
  2561. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2562. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2563. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
  2564. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2565. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\user32.dll
  2566. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2567. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2568. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
  2569. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2570. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\gdi32.dll
  2571. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2572. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2573. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
  2574. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2575. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  2576. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2577. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\kernel32.dll'
  2578. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2579. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2580. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2581. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2582. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2583. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2584. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2585. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2586. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2587. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2588. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2589. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2590. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2591. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2592. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2593. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2594. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2595. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2596. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2597. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2598. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2599. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2600. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2601. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2602. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2603. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2604. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2605. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2606. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2607. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2608. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2609. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2610. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2611. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2612. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2613. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2614. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2615. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2616. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2617. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2618. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  2619. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2620. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-string-l1-1-0'
  2621. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2622. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2623. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2624. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2625. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2626. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2627. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2628. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2629. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2630. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2631. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2632. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2633. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2634. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2635. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2636. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2637. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2638. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2639. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2640. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2641. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2642. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2643. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2644. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2645. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2646. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2647. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2648. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2649. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2650. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2651. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2652. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2653. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2654. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2655. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2656. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2657. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2658. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2659. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2660. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2661. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  2662. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2663. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-datetime-l1-1-1'
  2664. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2665. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2666. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2667. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2668. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2669. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2670. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2671. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2672. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2673. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2674. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2675. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2676. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2677. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2678. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2679. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2680. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2681. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2682. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2683. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2684. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2685. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2686. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2687. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2688. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2689. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2690. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2691. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2692. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2693. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2694. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2695. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2696. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2697. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2698. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2699. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2700. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2701. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2702. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2703. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2704. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  2705. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  2706. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-obsolete-l1-2-0'
  2707. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2708. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2709. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2710. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2711. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2712. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2713. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2714. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2715. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2716. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2717. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2718. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2719. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2720. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2721. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2722. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2723. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2724. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2725. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2726. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2727. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2728. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2729. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2730. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2731. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2732. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2733. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2734. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2735. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2736. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2737. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2738. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2739. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2740. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2741. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2742. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2743. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2744. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2745. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2746. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2747. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  2748. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  2749. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
  2750. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imm32.dll)
  2751. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imm32.dll
  2752. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  2753. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  2754. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
  2755. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2756. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
  2757. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2758. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2759. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
  2760. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2761. 3e68.3760: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\user32.dll
  2762. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  2763. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf47b0000 LB 0x00030000 C:\WINDOWS\System32\IMM32.DLL [fFlags=0x0]
  2764. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
  2765. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47b0000 'C:\WINDOWS\system32\IMM32.DLL'
  2766. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  2767. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
  2768. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2769. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2770. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2771. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2772. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2773. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2774. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2775. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2776. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2777. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2778. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2779. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2780. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2781. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2782. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2783. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2784. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2785. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2786. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2787. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2788. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  2789. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
  2790. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2791. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2792. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2793. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2794. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2795. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2796. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2797. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2798. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2799. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2800. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2801. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2802. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2803. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2804. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2805. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2806. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2807. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2808. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2809. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2810. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  2811. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2812. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5310000 'C:\WINDOWS\System32\ADVAPI32.DLL'
  2813. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
  2814. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
  2815. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
  2816. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
  2817. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
  2818. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
  2819. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
  2820. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
  2821. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
  2822. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
  2823. 3e68.3760: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
  2824. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
  2825. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
  2826. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
  2827. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
  2828. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
  2829. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
  2830. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
  2831. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
  2832. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
  2833. 3e68.3760: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
  2834. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
  2835. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffda4f80000 'C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll'
  2836. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2837. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2838. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll'
  2839. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2840. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2841. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'
  2842. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000490 pwszName=\Device\HarddiskVolume3\Windows\System32\glu32.dll
  2843. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  2844. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  2845. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0FEA41B8444B51E45D80438EF35CC443EA7D79A6
  2846. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2847. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2848. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\glu32.dll'
  2849. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2850. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll'
  2851. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2852. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2853. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll'
  2854. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2855. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2856. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll'
  2857. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2858. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'
  2859. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2860. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2861. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll'
  2862. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2863. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2864. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'
  2865. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2866. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2867. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\user32.dll'
  2868. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2869. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2870. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'
  2871. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2872. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2873. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\combase.dll'
  2874. 3e68.3760: SUPR3HardenedMain: Calling TrustedMain (00007ffda4f816c0)...
  2875. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
  2876. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
  2877. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'wldp.dll'.
  2878. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\windows.storage.dll)
  2879. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\windows.storage.dll
  2880. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2881. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wldp.dll)
  2882. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wldp.dll
  2883. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf31e0000 LB 0x0002e000 C:\WINDOWS\SYSTEM32\Wldp.dll [fFlags=0x0]
  2884. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wldp.dll [avoiding WinVerifyTrust]
  2885. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf1150000 LB 0x00794000 C:\WINDOWS\SYSTEM32\windows.storage.dll [fFlags=0x0]
  2886. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\windows.storage.dll [avoiding WinVerifyTrust]
  2887. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf4a10000 LB 0x000ad000 C:\WINDOWS\System32\SHCORE.dll [fFlags=0x0]
  2888. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2889. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'combase.dll'.
  2890. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\SHCore.dll)
  2891. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  2892. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf49b0000 LB 0x00055000 C:\WINDOWS\System32\shlwapi.dll [fFlags=0x0]
  2893. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  2894. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shlwapi.dll)
  2895. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  2896. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2897. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2898. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  2899. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2900. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2901. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  2902. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2903. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2904. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2905. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2906. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldp.dll'...
  2907. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldp.dll' -> '\Device\HarddiskVolume3\Windows\System32\wldp.dll' [rcNtRedir=0xc0150008]
  2908. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wldp.dll [lacks WinVerifyTrust]
  2909. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  2910. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  2911. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  2912. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  2913. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  2914. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  2915. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2916. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2917. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'
  2918. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2919. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2920. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'
  2921. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2922. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2923. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\wldp.dll'
  2924. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2925. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2926. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'
  2927. 3e68.3760: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll: Signature #1/2: info status: 24202
  2928. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2929. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2930. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  2931. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  2932. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  2933. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  2934. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2935. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2936. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  2937. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  2938. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  2939. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  2940. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  2941. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2942. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2943. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2944. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2945. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2946. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2947. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2948. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2949. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2950. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2951. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2952. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  2953. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2954. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2955. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  2956. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2957. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2958. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  2959. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2960. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2961. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  2962. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2963. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2964. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
  2965. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2966. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2967. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2968. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2969. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  2970. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2971. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2972. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  2973. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2974. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffd8bd10000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  2975. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2976. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8bd10000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  2977. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
  2978. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
  2979. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll)
  2980. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll
  2981. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf1900000 LB 0x00012000 C:\WINDOWS\SYSTEM32\kernel.appcore.dll [fFlags=0x0]
  2982. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll [avoiding WinVerifyTrust]
  2983. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  2984. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  2985. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2986. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2987. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2988. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2989. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'
  2990. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000005d0 pwszName=\Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  2991. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  2992. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  2993. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D52B5B313F26D198724C9A8532CECB1A8130856B
  2994. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  2995. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  2996. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0519~31bf3856ad364e35~amd64~~10.0.19041.1415.cat'; file='\Device\HarddiskVolume3\Windows\System32\uxtheme.dll'
  2997. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2998. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2999. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
  3000. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
  3001. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\uxtheme.dll) WinVerifyTrust
  3002. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  3003. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3004. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3005. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  3006. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  3007. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3008. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3009. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3010. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  3011. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf07e0000 LB 0x0009e000 C:\WINDOWS\system32\uxtheme.dll [fFlags=0x0]
  3012. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  3013. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf07e0000 'C:\WINDOWS\system32\uxtheme.dll'
  3014. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6170000 'C:\WINDOWS\system32\user32.dll'
  3015. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  3016. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3017. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  3018. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  3019. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3020. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4a10000 'C:\WINDOWS\system32\SHCore.dll'
  3021. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\WINDOWS\system32\wintab32.dll': 0 (NtPath=\??\C:\WINDOWS\system32\wintab32.dll; Input=C:\WINDOWS\system32\wintab32.dll; rcNtGetDll=0x0
  3022. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\WINDOWS\system32\wintab32.dll'
  3023. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  3024. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3025. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf0d80000 'C:\WINDOWS\system32\winmm.dll'
  3026. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
  3027. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3028. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf0d80000 'C:\WINDOWS\system32\winmm.dll'
  3029. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  3030. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3031. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  3032. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
  3033. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3034. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf07e0000 'C:\WINDOWS\system32\uxtheme.dll'
  3035. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  3036. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\advapi32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3037. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5310000 'C:\WINDOWS\system32\advapi32.dll'
  3038. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3039. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3040. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
  3041. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\userenv.dll) WinVerifyTrust
  3042. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\userenv.dll
  3043. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3044. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3045. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\userenv.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3046. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
  3047. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3d80000 LB 0x0002e000 C:\WINDOWS\system32\userenv.dll [fFlags=0x0]
  3048. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
  3049. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3d80000 'C:\WINDOWS\system32\userenv.dll'
  3050. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  3051. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3052. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\kernel32.dll'
  3053. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf5260000 LB 0x000a9000 C:\WINDOWS\System32\clbcatq.dll [fFlags=0x0]
  3054. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3055. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
  3056. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\clbcatq.dll)
  3057. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\clbcatq.dll
  3058. 3e68.990: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  3059. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3060. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3061. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3062. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3063. 3e68.990: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3064. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3065. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3066. 3e68.990: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\clbcatq.dll'
  3067. 3e68.990: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll: Signature #1/2: info status: 24202
  3068. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3069. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3070. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3071. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3072. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  3073. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  3074. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  3075. 3e68.990: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
  3076. 3e68.990: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  3077. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3078. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3079. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  3080. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  3081. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  3082. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  3083. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  3084. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  3085. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  3086. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3087. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3088. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3089. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3090. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
  3091. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3092. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3093. 3e68.990: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3094. 3e68.990: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  3095. 3e68.990: supR3HardenedDllNotificationCallback: load 00007ffd8b850000 LB 0x003c1000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
  3096. 3e68.990: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  3097. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8b850000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
  3098. 3e68.990: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll: Signature #1/2: info status: 24202
  3099. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3100. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3101. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3102. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  3103. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
  3104. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
  3105. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
  3106. 3e68.990: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  3107. 3e68.990: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
  3108. 3e68.990: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  3109. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3110. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3111. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3112. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3113. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  3114. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  3115. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  3116. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  3117. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  3118. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  3119. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
  3120. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  3121. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  3122. 3e68.990: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
  3123. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3124. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3125. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3126. 3e68.990: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3127. 3e68.990: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3128. 3e68.990: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  3129. 3e68.990: supR3HardenedDllNotificationCallback: load 00007ffd8bc20000 LB 0x000ef000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
  3130. 3e68.990: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
  3131. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8bc20000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
  3132. 3e68.990: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  3133. 3e68.990: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3134. 3e68.990: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf64b0000 'C:\Windows\System32\oleaut32.dll'
  3135. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6320000 'C:\WINDOWS\system32\gdi32.dll'
  3136. 3e68.c78: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3137. 3e68.c78: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3138. 3e68.c78: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll: Signature #1/2: info status: 24202
  3139. 3e68.c78: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3140. 3e68.c78: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3141. 3e68.c78: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3142. 3e68.c78: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll) WinVerifyTrust
  3143. 3e68.c78: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  3144. 3e68.c78: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3145. 3e68.c78: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3146. 3e68.c78: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3147. 3e68.c78: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3148. 3e68.c78: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3149. 3e68.c78: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  3150. 3e68.c78: supR3HardenedDllNotificationCallback: load 00007ffde9290000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [fFlags=0x0]
  3151. 3e68.c78: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
  3152. 3e68.c78: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde9290000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL'
  3153. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf6610000 LB 0x00115000 C:\WINDOWS\System32\MSCTF.dll [fFlags=0x0]
  3154. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3155. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'oleaut32.dll'.
  3156. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'user32.dll'.
  3157. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
  3158. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'imm32.dll'.
  3159. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msctf.dll)
  3160. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msctf.dll
  3161. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  3162. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  3163. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
  3164. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  3165. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  3166. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3167. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3168. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3169. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3170. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  3171. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3172. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3173. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3174. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3175. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msctf.dll'
  3176. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000009c0 pwszName=\Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  3177. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3178. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3179. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F602E8855BCD942955FA9DBB13C4E4D44C41A311
  3180. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3181. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3182. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.19041.1415.cat'; file='\Device\HarddiskVolume3\Windows\System32\DataExchange.dll'
  3183. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3184. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3185. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'd3d11.dll'.
  3186. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'dcomp.dll'.
  3187. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\DataExchange.dll) WinVerifyTrust
  3188. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  3189. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
  3190. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' -> '\Device\HarddiskVolume3\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
  3191. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3192. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3193. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
  3194. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp_win.dll'.
  3195. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dcomp.dll) WinVerifyTrust
  3196. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  3197. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
  3198. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume3\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
  3199. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  3200. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  3201. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  3202. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  3203. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  3204. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll
  3205. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3206. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3207. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3208. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'dxgi.dll'.
  3209. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'win32u.dll'.
  3210. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\d3d11.dll) WinVerifyTrust
  3211. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  3212. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3213. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3214. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  3215. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  3216. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll
  3217. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
  3218. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume3\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
  3219. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3220. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3221. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3222. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'win32u.dll'.
  3223. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dxgi.dll) WinVerifyTrust
  3224. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dxgi.dll
  3225. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3226. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3227. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
  3228. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
  3229. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
  3230. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll
  3231. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3232. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3233. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3234. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  3235. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  3236. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  3237. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll
  3238. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf1970000 LB 0x000f4000 C:\WINDOWS\system32\dxgi.dll [fFlags=0x0]
  3239. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll
  3240. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdef230000 LB 0x00264000 C:\WINDOWS\system32\d3d11.dll [fFlags=0x0]
  3241. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
  3242. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdefa60000 LB 0x001e5000 C:\WINDOWS\system32\dcomp.dll [fFlags=0x0]
  3243. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
  3244. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdbf770000 LB 0x0003e000 C:\WINDOWS\system32\dataexchange.dll [fFlags=0x0]
  3245. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
  3246. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6320000 'C:\WINDOWS\System32\gdi32.dll'
  3247. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdbf770000 'C:\WINDOWS\system32\dataexchange.dll'
  3248. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
  3249. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
  3250. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'msvcp_win.dll'.
  3251. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll)
  3252. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll
  3253. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdeda20000 LB 0x00201000 C:\WINDOWS\system32\twinapi.appcore.dll [fFlags=0x0]
  3254. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
  3255. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  3256. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  3257. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  3258. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  3259. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  3260. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  3261. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3262. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3263. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
  3264. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3265. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3266. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll'
  3267. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  3268. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Shcore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3269. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4a10000 'C:\WINDOWS\system32\Shcore.dll'
  3270. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3271. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'oleaut32.dll'.
  3272. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  3273. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'coreuicomponents.dll'.
  3274. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'coremessaging.dll'.
  3275. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll)
  3276. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll
  3277. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3278. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'coremessaging.dll'.
  3279. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'rpcrt4.dll'.
  3280. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'shcore.dll'.
  3281. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll)
  3282. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll
  3283. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3284. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'ws2_32.dll'.
  3285. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll)
  3286. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll
  3287. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntmarta.dll)
  3288. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntmarta.dll
  3289. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
  3290. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
  3291. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'bcryptprimitives.dll'.
  3292. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\WinTypes.dll)
  3293. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\WinTypes.dll
  3294. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf3b50000 LB 0x00033000 C:\WINDOWS\SYSTEM32\ntmarta.dll [fFlags=0x0]
  3295. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
  3296. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf0410000 LB 0x000f2000 C:\WINDOWS\System32\CoreMessaging.dll [fFlags=0x0]
  3297. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [avoiding WinVerifyTrust]
  3298. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdeec70000 LB 0x00154000 C:\WINDOWS\SYSTEM32\wintypes.dll [fFlags=0x0]
  3299. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
  3300. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdefd30000 LB 0x0035e000 C:\WINDOWS\System32\CoreUIComponents.dll [fFlags=0x0]
  3301. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [avoiding WinVerifyTrust]
  3302. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffde6240000 LB 0x000f9000 C:\WINDOWS\SYSTEM32\textinputframework.dll [fFlags=0x0]
  3303. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll [avoiding WinVerifyTrust]
  3304. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
  3305. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
  3306. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
  3307. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3308. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3309. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
  3310. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
  3311. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
  3312. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  3313. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  3314. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  3315. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3316. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3317. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
  3318. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
  3319. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
  3320. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3321. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3322. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  3323. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  3324. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  3325. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3326. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3327. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
  3328. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
  3329. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
  3330. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coreuicomponents.dll'...
  3331. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' -> '\Device\HarddiskVolume3\Windows\System32\coreuicomponents.dll' [rcNtRedir=0xc0150008]
  3332. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [lacks WinVerifyTrust]
  3333. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3334. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3335. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3336. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3337. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
  3338. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3339. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3340. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3341. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3342. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\WinTypes.dll'
  3343. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3344. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3345. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ntmarta.dll'
  3346. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3347. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3348. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll'
  3349. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3350. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3351. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll'
  3352. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3353. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3354. 3e68.3760: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll'
  3355. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll) -> 0x0, fPresent=1
  3356. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3357. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6170000 'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll'
  3358. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll) -> 0x0, fPresent=1
  3359. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3360. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6170000 'ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll'
  3361. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-com-l1-1-0.dll) -> 0x0, fPresent=1
  3362. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-com-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3363. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5430000 'api-ms-win-core-com-l1-1-0.dll'
  3364. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
  3365. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3366. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6610000 'C:\WINDOWS\System32\MSCTF.dll'
  3367. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b40 pwszName=\Device\HarddiskVolume3\Windows\System32\oleacc.dll
  3368. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3369. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3370. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8F5F6FD89BE6BD7C0A280D2BF2CB2B19B0118938
  3371. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3372. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
  3373. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3374. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3375. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05111~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\oleacc.dll'
  3376. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3377. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
  3378. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleacc.dll) WinVerifyTrust
  3379. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleacc.dll
  3380. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3381. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3382. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\oleacc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3383. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleacc.dll
  3384. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffddf9e0000 LB 0x00066000 C:\WINDOWS\system32\oleacc.dll [fFlags=0x0]
  3385. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleacc.dll
  3386. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffddf9e0000 'C:\WINDOWS\system32\oleacc.dll'
  3387. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf64b0000 'C:\WINDOWS\System32\OLEAUT32.DLL'
  3388. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleacc.dll
  3389. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleacc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3390. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffddf9e0000 'C:\Windows\System32\oleacc.dll'
  3391. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  3392. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3393. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  3394. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
  3395. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3396. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  3397. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
  3398. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3399. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47e0000 'C:\WINDOWS\System32\ole32.dll'
  3400. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf64b0000 'C:\WINDOWS\System32\OLEAUT32.dll'
  3401. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a44 pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  3402. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3403. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3404. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D5E9B4B8E891F6D9AAF89D119CB8AAE1934ED673
  3405. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3406. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3407. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll'
  3408. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3409. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3410. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  3411. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
  3412. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
  3413. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  3414. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  3415. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  3416. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b2c pwszName=\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  3417. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3418. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3419. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3171C0A71232B61EEEB57057418104E9B8748536
  3420. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3421. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3422. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll'
  3423. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3424. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3425. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll) WinVerifyTrust
  3426. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  3427. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  3428. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  3429. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  3430. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3431. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3432. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3433. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3434. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3435. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  3436. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  3437. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffde8ed0000 LB 0x00092000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [fFlags=0x0]
  3438. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  3439. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdeaad0000 LB 0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [fFlags=0x0]
  3440. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
  3441. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
  3442. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3443. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  3444. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeaad0000 'C:\WINDOWS\system32\wbem\wbemprox.dll'
  3445. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b70 pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  3446. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3447. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3448. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8CA332CD27CD01F33F85EB4BED516FAA617B555A
  3449. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3450. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3451. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll'
  3452. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3453. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3454. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
  3455. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
  3456. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  3457. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3458. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3459. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3460. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3461. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3462. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  3463. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdec820000 LB 0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [fFlags=0x0]
  3464. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
  3465. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdec820000 'C:\WINDOWS\system32\wbem\wbemsvc.dll'
  3466. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
  3467. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3468. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-l1-2-0.dll'
  3469. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
  3470. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
  3471. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
  3472. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b30 pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  3473. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3474. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3475. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=184DC69A17259EC62BC6A74793DCE28D7CC5A1AC
  3476. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3477. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3478. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll'
  3479. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3480. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3481. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'wbemcomn.dll'.
  3482. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
  3483. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  3484. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
  3485. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
  3486. 3e68.3760: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
  3487. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3488. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3489. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  3490. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  3491. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffde8420000 LB 0x0010b000 C:\WINDOWS\system32\wbem\fastprox.dll [fFlags=0x0]
  3492. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
  3493. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde8420000 'C:\WINDOWS\system32\wbem\fastprox.dll'
  3494. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b58 pwszName=\Device\HarddiskVolume3\Windows\System32\amsi.dll
  3495. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3496. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3497. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=245B8E27DCB2C7A41C4202082696F699C79E039C
  3498. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3499. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3500. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05~31bf3856ad364e35~amd64~~10.0.19041.1348.cat'; file='\Device\HarddiskVolume3\Windows\System32\amsi.dll'
  3501. 3e68.3760: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3502. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3503. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  3504. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\amsi.dll) WinVerifyTrust
  3505. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\amsi.dll
  3506. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3507. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3508. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3509. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3510. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\amsi.dll (Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3511. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\amsi.dll
  3512. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffde91f0000 LB 0x00019000 C:\WINDOWS\System32\amsi.dll [fFlags=0x0]
  3513. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\amsi.dll
  3514. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde91f0000 'C:\WINDOWS\System32\amsi.dll'
  3515. 3e68.3760: \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll: Owner is administrators group.
  3516. 3e68.3760: \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll: Signature #1/2: info status: 24202
  3517. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3518. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  3519. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'ole32.dll'.
  3520. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'version.dll'.
  3521. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll) WinVerifyTrust
  3522. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll
  3523. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
  3524. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume3\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
  3525. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3526. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3527. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3528. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\version.dll) WinVerifyTrust
  3529. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\version.dll
  3530. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  3531. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  3532. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  3533. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  3534. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3535. 3e68.3760: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3536. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3537. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll
  3538. 3e68.3760: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
  3539. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdf1bd0000 LB 0x0000a000 C:\WINDOWS\SYSTEM32\VERSION.dll [fFlags=0x0]
  3540. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
  3541. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffdcd2f0000 LB 0x000af000 C:\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll [fFlags=0x0]
  3542. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll
  3543. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  3544. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3545. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-synch-l1-2-0'
  3546. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  3547. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3548. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-fibers-l1-1-1'
  3549. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
  3550. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3551. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-synch-l1-2-0'
  3552. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
  3553. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3554. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-fibers-l1-1-1'
  3555. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
  3556. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3557. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-l1-2-1'
  3558. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
  3559. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3560. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf63f0000 'C:\WINDOWS\System32\kernel32.dll'
  3561. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
  3562. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3563. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-string-l1-1-0'
  3564. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
  3565. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3566. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-datetime-l1-1-1'
  3567. 3e68.3760: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
  3568. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
  3569. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3fe0000 'api-ms-win-core-localization-obsolete-l1-2-0'
  3570. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdcd2f0000 'C:\Program Files\Bitdefender Antivirus Free\bdamsi\265691267036524441\antimalware_provider64.dll'
  3571. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5310000 'C:\WINDOWS\System32\ADVAPI32.dll'
  3572. 3e68.19ec: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll: Signature #1/2: info status: 24202
  3573. 3e68.19ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3574. 3e68.19ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3575. 3e68.19ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3576. 3e68.19ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
  3577. 3e68.19ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3578. 3e68.19ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3579. 3e68.19ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3580. 3e68.19ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3581. 3e68.19ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3582. 3e68.19ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3583. 3e68.19ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3584. 3e68.19ec: supR3HardenedDllNotificationCallback: load 00007ffda1f60000 LB 0x0037c000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
  3585. 3e68.19ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3586. 3e68.19ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffda1f60000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  3587. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47e0000 'C:\WINDOWS\system32\ole32.dll'
  3588. 3e68.864: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47e0000 'C:\WINDOWS\system32\ole32.dll'
  3589. 3e68.36ac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47e0000 'C:\WINDOWS\system32\ole32.dll'
  3590. 3e68.4b6c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf47e0000 'C:\WINDOWS\system32\ole32.dll'
  3591. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3592. 3e68.5520: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll: Signature #1/2: info status: 24202
  3593. 3e68.5520: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3594. 3e68.5520: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3595. 3e68.5520: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3596. 3e68.5520: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  3597. 3e68.5520: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  3598. 3e68.5520: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
  3599. 3e68.5520: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
  3600. 3e68.5520: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  3601. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3602. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3603. 3e68.5520: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
  3604. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3605. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3606. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  3607. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  3608. 3e68.5520: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3609. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3610. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3611. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3612. 3e68.5520: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3613. 3e68.5520: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3614. 3e68.5520: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  3615. 3e68.5520: supR3HardenedDllNotificationCallback: load 00007ffde9220000 LB 0x00010000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
  3616. 3e68.5520: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
  3617. 3e68.5520: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde9220000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
  3618. 3e68.3704: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll: Signature #1/2: info status: 24202
  3619. 3e68.3704: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3620. 3e68.3704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3621. 3e68.3704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3622. 3e68.3704: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3623. 3e68.3704: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
  3624. 3e68.3704: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  3625. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3626. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3627. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3628. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3629. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3630. 3e68.3704: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3631. 3e68.3704: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
  3632. 3e68.3704: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3633. 3e68.3704: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  3634. 3e68.3704: supR3HardenedDllNotificationCallback: load 00007ffde9210000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
  3635. 3e68.3704: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
  3636. 3e68.3704: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde9210000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
  3637. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\Shell32.dll'
  3638. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3639. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3640. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffda1f60000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
  3641. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll: Signature #1/2: info status: 24202
  3642. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3643. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3644. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3645. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  3646. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
  3647. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  3648. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll) WinVerifyTrust
  3649. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3650. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  3651. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  3652. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  3653. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  3654. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3655. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3656. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3657. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3658. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3659. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3660. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3661. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3662. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffda4f30000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
  3663. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3664. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffda4f30000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
  3665. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffda4f30000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
  3666. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3667. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll: Signature #1/2: info status: 24202
  3668. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3669. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3670. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  3671. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3672. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
  3673. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
  3674. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  3675. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  3676. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
  3677. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
  3678. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
  3679. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
  3680. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  3681. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
  3682. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
  3683. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3684. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3685. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
  3686. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  3687. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  3688. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  3689. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  3690. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  3691. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  3692. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  3693. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  3694. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3695. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3696. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  3697. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'rpcrt4.dll'.
  3698. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'cfgmgr32.dll'.
  3699. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'bcrypt.dll'.
  3700. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\setupapi.dll) WinVerifyTrust
  3701. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  3702. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3703. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3704. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
  3705. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
  3706. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll: Signature #1/2: info status: 24202
  3707. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  3708. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  3709. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
  3710. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  3711. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  3712. 3e68.3b24: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
  3713. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll)
  3714. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
  3715. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3716. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3717. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  3718. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  3719. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3720. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3721. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3722. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
  3723. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  3724. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
  3725. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
  3726. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll: Signature #1/2: info status: 24202
  3727. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3728. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3729. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3730. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3731. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3732. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3733. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3734. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  3735. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
  3736. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
  3737. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
  3738. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  3739. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3740. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3741. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  3742. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  3743. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3744. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3745. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3746. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  3747. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  3748. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  3749. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  3750. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  3751. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  3752. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  3753. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3754. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3755. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3756. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3757. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3758. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  3759. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  3760. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  3761. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  3762. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf3e80000 LB 0x0004e000 C:\WINDOWS\System32\cfgmgr32.dll [fFlags=0x0]
  3763. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll [avoiding WinVerifyTrust]
  3764. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf4c00000 LB 0x00472000 C:\WINDOWS\System32\SETUPAPI.dll [fFlags=0x0]
  3765. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
  3766. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffd8b510000 LB 0x00066000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
  3767. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
  3768. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffd43eb0000 LB 0x0085c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
  3769. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  3770. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf2c30000 LB 0x0003b000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
  3771. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  3772. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffd44710000 LB 0x00a04000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
  3773. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
  3774. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd44710000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
  3775. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3776. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3777. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'
  3778. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3779. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3780. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3781. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3782. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffda4f30000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
  3783. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
  3784. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffda4f30000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
  3785. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3786. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
  3787. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3788. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd8b850000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
  3789. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3790. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
  3791. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3792. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffd43eb0000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
  3793. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3794. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll: Signature #1/2: info status: 24202
  3795. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3796. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3797. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3798. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll) WinVerifyTrust
  3799. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  3800. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3801. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3802. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3803. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3804. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3805. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  3806. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffde6600000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [fFlags=0x0]
  3807. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
  3808. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde6600000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL'
  3809. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3810. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll: Signature #1/2: info status: 24202
  3811. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3812. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3813. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3814. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll) WinVerifyTrust
  3815. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  3816. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3817. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3818. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3819. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3820. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3821. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  3822. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdcc1f0000 LB 0x00012000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [fFlags=0x0]
  3823. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
  3824. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdcc1f0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL'
  3825. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3826. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll: Signature #1/2: info status: 24202
  3827. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3828. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3829. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3830. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll) WinVerifyTrust
  3831. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  3832. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3833. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3834. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3835. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3836. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3837. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  3838. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdbd4c0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [fFlags=0x0]
  3839. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
  3840. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdbd4c0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL'
  3841. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3842. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll: Signature #1/2: info status: 24202
  3843. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3844. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3845. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3846. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll) WinVerifyTrust
  3847. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  3848. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3849. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3850. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3851. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3852. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3853. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  3854. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdb11c0000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [fFlags=0x0]
  3855. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
  3856. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdb11c0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL'
  3857. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3858. 3e68.3898: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll: Signature #1/2: info status: 24202
  3859. 3e68.3898: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3860. 3e68.3898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3861. 3e68.3898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
  3862. 3e68.3898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3863. 3e68.3898: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
  3864. 3e68.3898: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  3865. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3866. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3867. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  3868. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  3869. 3e68.3898: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3870. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3871. 3e68.3898: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3872. 3e68.3898: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3873. 3e68.3898: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  3874. 3e68.3898: supR3HardenedDllNotificationCallback: load 00007ffdad2f0000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
  3875. 3e68.3898: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
  3876. 3e68.3898: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdad2f0000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
  3877. 3e68.2e44: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll: Signature #1/2: info status: 24202
  3878. 3e68.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3879. 3e68.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3880. 3e68.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3881. 3e68.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
  3882. 3e68.2e44: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
  3883. 3e68.2e44: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
  3884. 3e68.2e44: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3885. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3886. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3887. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
  3888. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
  3889. 3e68.2e44: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
  3890. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3891. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3892. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3893. 3e68.2e44: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3894. 3e68.2e44: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3895. 3e68.2e44: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3896. 3e68.2e44: supR3HardenedDllNotificationCallback: load 00007ffde8c40000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
  3897. 3e68.2e44: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
  3898. 3e68.2e44: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffde8c40000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
  3899. 3e68.4620: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll: Signature #1/2: info status: 24202
  3900. 3e68.4620: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3901. 3e68.4620: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3902. 3e68.4620: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  3903. 3e68.4620: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
  3904. 3e68.4620: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
  3905. 3e68.4620: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3906. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3907. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3908. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  3909. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  3910. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3911. 3e68.4620: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3912. 3e68.4620: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3913. 3e68.4620: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3914. 3e68.4620: supR3HardenedDllNotificationCallback: load 00007ffdde340000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
  3915. 3e68.4620: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
  3916. 3e68.4620: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdde340000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
  3917. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3918. 3e68.3b24: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll: Signature #1/2: info status: 24202
  3919. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3920. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  3921. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  3922. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll) WinVerifyTrust
  3923. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  3924. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  3925. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  3926. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  3927. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  3928. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3929. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  3930. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdaaf00000 LB 0x0000a000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL [fFlags=0x0]
  3931. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
  3932. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdaaf00000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL'
  3933. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
  3934. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Iphlpapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  3935. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2c30000 'C:\WINDOWS\system32\Iphlpapi.dll'
  3936. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  3937. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
  3938. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winnsi.dll)
  3939. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winnsi.dll
  3940. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf5250000 LB 0x00008000 C:\WINDOWS\System32\NSI.dll [fFlags=0x0]
  3941. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\nsi.dll)
  3942. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\nsi.dll
  3943. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdee4a0000 LB 0x0000b000 C:\WINDOWS\SYSTEM32\WINNSI.DLL [fFlags=0x0]
  3944. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
  3945. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  3946. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll)
  3947. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll
  3948. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffded5a0000 LB 0x00017000 C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL [fFlags=0x0]
  3949. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll [avoiding WinVerifyTrust]
  3950. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
  3951. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll)
  3952. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll
  3953. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffded4d0000 LB 0x0001d000 C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL [fFlags=0x0]
  3954. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll [avoiding WinVerifyTrust]
  3955. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dnsapi.dll)
  3956. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dnsapi.dll
  3957. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf2c70000 LB 0x000cb000 C:\WINDOWS\SYSTEM32\DNSAPI.dll [fFlags=0x0]
  3958. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dnsapi.dll [avoiding WinVerifyTrust]
  3959. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3960. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3961. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3962. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3963. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  3964. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  3965. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\nsi.dll [lacks WinVerifyTrust]
  3966. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  3967. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  3968. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3969. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3970. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dnsapi.dll'
  3971. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ffc pwszName=\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll
  3972. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3973. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3974. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DCAD48333E2A4922B628484108339A2EED2CAAA4
  3975. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3976. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3977. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.1288.cat'; file='\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll'
  3978. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3979. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dhcpcsvc.dll'
  3980. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ff4 pwszName=\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll
  3981. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  3982. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  3983. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3B30BEFD11A7A908BF866683855A2B32DDCBE496
  3984. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3985. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3986. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.1288.cat'; file='\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll'
  3987. 3e68.3b24: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  3988. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\dhcpcsvc6.dll'
  3989. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3990. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3991. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\nsi.dll'
  3992. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3993. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3994. 3e68.3b24: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\winnsi.dll'
  3995. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  3996. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  3997. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  3998. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  3999. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'devobj.dll'.
  4000. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll) WinVerifyTrust
  4001. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  4002. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  4003. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume3\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  4004. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4005. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4006. 3e68.3b24: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'cfgmgr32.dll'.
  4007. 3e68.3b24: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\devobj.dll) WinVerifyTrust
  4008. 3e68.3b24: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\devobj.dll
  4009. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  4010. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  4011. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  4012. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  4013. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  4014. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  4015. 3e68.3b24: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  4016. 3e68.3b24: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
  4017. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
  4018. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  4019. 3e68.3b24: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
  4020. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdf3bb0000 LB 0x00034000 C:\WINDOWS\System32\DEVOBJ.dll [fFlags=0x0]
  4021. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
  4022. 3e68.3b24: supR3HardenedDllNotificationCallback: load 00007ffdeadf0000 LB 0x00085000 C:\WINDOWS\System32\MMDevApi.dll [fFlags=0x0]
  4023. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  4024. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeadf0000 'C:\WINDOWS\System32\MMDevApi.dll'
  4025. 3e68.3b24: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  4026. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  4027. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeadf0000 'C:\WINDOWS\System32\MMDEVAPI.DLL'
  4028. 3e68.3b24: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4029. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  4030. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  4031. 3e68.49f4: '\Device\HarddiskVolume3\Windows\System32\tzres.dll' has no imports
  4032. 3e68.49f4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\tzres.dll)
  4033. 3e68.49f4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\tzres.dll
  4034. 3e68.49f4: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001234 (hFile=0000000000001220) with 0xc0000022 -> STATUS_TRUST_FAILURE
  4035. 3e68.49f4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\tzres.dll [avoiding WinVerifyTrust]
  4036. 3e68.49f4: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001220 (hFile=0000000000001234) with 0xc0000022 -> STATUS_TRUST_FAILURE
  4037. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001230 pwszName=\Device\HarddiskVolume3\Windows\System32\tzres.dll
  4038. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 0000000001077710
  4039. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=0000000001077710
  4040. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E839801282351DA34C3C3D030DE51DC353C9836
  4041. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4042. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4043. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.1415.cat'; file='\Device\HarddiskVolume3\Windows\System32\tzres.dll'
  4044. 3e68.49f4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  4045. 3e68.49f4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\tzres.dll'
  4046. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4047. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4048. 3e68.49f4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'ws2_32.dll'.
  4049. 3e68.49f4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
  4050. 3e68.49f4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mswsock.dll) WinVerifyTrust
  4051. 3e68.49f4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  4052. 3e68.49f4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  4053. 3e68.49f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  4054. 3e68.49f4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  4055. 3e68.49f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  4056. 3e68.49f4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
  4057. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\mswsock.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  4058. 3e68.49f4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  4059. 3e68.49f4: supR3HardenedDllNotificationCallback: load 00007ffdf3080000 LB 0x0006a000 C:\WINDOWS\system32\mswsock.dll [fFlags=0x0]
  4060. 3e68.49f4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mswsock.dll
  4061. 3e68.49f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf3080000 'C:\WINDOWS\system32\mswsock.dll'
  4062. 3e68.9f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
  4063. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  4064. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4065. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4066. 3e68.9f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  4067. 3e68.9f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
  4068. 3e68.9f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
  4069. 3e68.9f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'mmdevapi.dll'.
  4070. 3e68.9f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\AudioSes.dll) WinVerifyTrust
  4071. 3e68.9f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  4072. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
  4073. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
  4074. 3e68.9f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
  4075. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  4076. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  4077. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  4078. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  4079. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
  4080. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
  4081. 3e68.9f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
  4082. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
  4083. 3e68.9f0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  4084. 3e68.9f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  4085. 3e68.9f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\powrprof.dll)
  4086. 3e68.9f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\powrprof.dll
  4087. 3e68.9f0: supR3HardenedDllNotificationCallback: load 00007ffdf3c40000 LB 0x0004b000 C:\WINDOWS\SYSTEM32\powrprof.dll [fFlags=0x0]
  4088. 3e68.9f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\powrprof.dll [avoiding WinVerifyTrust]
  4089. 3e68.9f0: supR3HardenedDllNotificationCallback: load 00007ffdeae80000 LB 0x00181000 C:\WINDOWS\System32\AUDIOSES.DLL [fFlags=0x0]
  4090. 3e68.9f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
  4091. 3e68.9f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\umpdc.dll)
  4092. 3e68.9f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\umpdc.dll
  4093. 3e68.9f0: supR3HardenedDllNotificationCallback: load 00007ffdf3c20000 LB 0x00012000 C:\WINDOWS\SYSTEM32\UMPDC.dll [fFlags=0x0]
  4094. 3e68.9f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\umpdc.dll [avoiding WinVerifyTrust]
  4095. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdeae80000 'C:\WINDOWS\System32\AUDIOSES.DLL'
  4096. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  4097. 3e68.9f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  4098. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4099. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4100. 3e68.9f0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'
  4101. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf2880000 'C:\WINDOWS\system32\rsaenh.dll'
  4102. 3e68.9f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf4570000 'C:\WINDOWS\System32\crypt32.dll'
  4103. 3e68.9f0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'
  4104. 3e68.5520: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf6170000 'C:\WINDOWS\system32\User32.dll'
  4105. 3e68.3760: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffdf5790000 'C:\WINDOWS\system32\shell32.dll'
  4106. 3e68.4620: supR3HardenedDllNotificationCallback: Unload 00007ffdde340000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [flags=0x0]
  4107. 3e68.2e44: supR3HardenedDllNotificationCallback: Unload 00007ffde8c40000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [flags=0x0]
  4108. 3e68.3898: supR3HardenedDllNotificationCallback: Unload 00007ffdad2f0000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [flags=0x0]
  4109. 3e68.3704: supR3HardenedDllNotificationCallback: Unload 00007ffde9210000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [flags=0x0]
  4110. 3e68.5520: supR3HardenedDllNotificationCallback: Unload 00007ffde9220000 LB 0x00010000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [flags=0x0]
  4111. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffdb11c0000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [flags=0x0]
  4112. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffdbd4c0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [flags=0x0]
  4113. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffdcc1f0000 LB 0x00012000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [flags=0x0]
  4114. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffde6600000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [flags=0x0]
  4115. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffda4f30000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
  4116. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffd44710000 LB 0x00a04000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [flags=0x0]
  4117. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffd8b510000 LB 0x00066000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [flags=0x0]
  4118. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffd43eb0000 LB 0x0085c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [flags=0x0]
  4119. 3e68.3b24: supR3HardenedDllNotificationCallback: Unload 00007ffdf4c00000 LB 0x00472000 C:\WINDOWS\System32\SETUPAPI.dll [flags=0x0]
  4120. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffde9290000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [flags=0x0]
  4121. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdec820000 LB 0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [flags=0x0]
  4122. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdbf770000 LB 0x0003e000 C:\WINDOWS\system32\dataexchange.dll [flags=0x0]
  4123. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
  4124. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  4125. 3e68.3760: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'win32u.dll'.
  4126. 3e68.3760: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\DXCore.dll)
  4127. 3e68.3760: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\DXCore.dll
  4128. 3e68.3760: supR3HardenedDllNotificationCallback: load 00007ffde8fe0000 LB 0x0003b000 C:\WINDOWS\SYSTEM32\dxcore.dll [fFlags=0x0]
  4129. 3e68.3760: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DXCore.dll [avoiding WinVerifyTrust]
  4130. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdef230000 LB 0x00264000 C:\WINDOWS\system32\d3d11.dll [flags=0x0]
  4131. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdf1970000 LB 0x000f4000 C:\WINDOWS\system32\dxgi.dll [flags=0x0]
  4132. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdefa60000 LB 0x001e5000 C:\WINDOWS\system32\dcomp.dll [flags=0x0]
  4133. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdeda20000 LB 0x00201000 C:\WINDOWS\system32\twinapi.appcore.dll [flags=0x0]
  4134. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffde8420000 LB 0x0010b000 C:\WINDOWS\system32\wbem\fastprox.dll [flags=0x0]
  4135. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffd8bc20000 LB 0x000ef000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [flags=0x0]
  4136. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffdeaad0000 LB 0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [flags=0x0]
  4137. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffde8ed0000 LB 0x00092000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [flags=0x0]
  4138. 3e68.3760: supR3HardenedDllNotificationCallback: Unload 00007ffd8b850000 LB 0x003c1000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [flags=0x0]
  4139. 3e68.3760: Terminating the normal way: rcExit=0
  4140. 6558.2ef4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 370876 ms, the end);
  4141. 27c8.36b8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 371844 ms, the end);
  4142.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!