API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jul 26th, 2018
550
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 270.16 KB | None | 0 0
raw download clone embed print report
  1. 318.d10: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110
  2. 318.d10: \SystemRoot\System32\ntdll.dll:
  3. 318.d10: CreationTime: 2010-11-21T03:23:51.351694200Z
  4. 318.d10: LastWriteTime: 2010-11-21T03:23:51.367294200Z
  5. 318.d10: ChangeTime: 2018-05-18T11:05:42.819872000Z
  6. 318.d10: FileAttributes: 0x20
  7. 318.d10: Size: 0x1a6d60
  8. 318.d10: NT Headers: 0xe0
  9. 318.d10: Timestamp: 0x4ce7c8f9
  10. 318.d10: Machine: 0x8664 - amd64
  11. 318.d10: Timestamp: 0x4ce7c8f9
  12. 318.d10: Image Version: 6.1
  13. 318.d10: SizeOfImage: 0x1a9000 (1740800)
  14. 318.d10: Resource Dir: 0x151000 LB 0x560d8
  15. 318.d10: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 318.d10: [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 318.d10: ProductName: Microsoft® Windows® Operating System
  18. 318.d10: ProductVersion: 6.1.7601.17514
  19. 318.d10: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  20. 318.d10: FileDescription: NT Layer DLL
  21. 318.d10: \SystemRoot\System32\kernel32.dll:
  22. 318.d10: CreationTime: 2010-11-21T03:24:07.965723400Z
  23. 318.d10: LastWriteTime: 2010-11-21T03:24:07.981323400Z
  24. 318.d10: ChangeTime: 2018-05-18T11:05:14.739822700Z
  25. 318.d10: FileAttributes: 0x20
  26. 318.d10: Size: 0x11b800
  27. 318.d10: NT Headers: 0xe8
  28. 318.d10: Timestamp: 0x4ce7c78b
  29. 318.d10: Machine: 0x8664 - amd64
  30. 318.d10: Timestamp: 0x4ce7c78b
  31. 318.d10: Image Version: 6.1
  32. 318.d10: SizeOfImage: 0x11f000 (1175552)
  33. 318.d10: Resource Dir: 0x116000 LB 0x528
  34. 318.d10: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 318.d10: [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 318.d10: ProductName: Microsoft® Windows® Operating System
  37. 318.d10: ProductVersion: 6.1.7601.17514
  38. 318.d10: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  39. 318.d10: FileDescription: Windows NT BASE API Client DLL
  40. 318.d10: \SystemRoot\System32\KernelBase.dll:
  41. 318.d10: CreationTime: 2010-11-21T03:24:26.217755400Z
  42. 318.d10: LastWriteTime: 2010-11-21T03:24:26.248955500Z
  43. 318.d10: ChangeTime: 2018-05-18T11:05:14.755422700Z
  44. 318.d10: FileAttributes: 0x20
  45. 318.d10: Size: 0x66800
  46. 318.d10: NT Headers: 0xf0
  47. 318.d10: Timestamp: 0x4ce7c78c
  48. 318.d10: Machine: 0x8664 - amd64
  49. 318.d10: Timestamp: 0x4ce7c78c
  50. 318.d10: Image Version: 6.1
  51. 318.d10: SizeOfImage: 0x6b000 (438272)
  52. 318.d10: Resource Dir: 0x69000 LB 0x530
  53. 318.d10: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 318.d10: [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  55. 318.d10: ProductName: Microsoft® Windows® Operating System
  56. 318.d10: ProductVersion: 6.1.7601.17514
  57. 318.d10: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  58. 318.d10: FileDescription: Windows NT BASE API Client DLL
  59. 318.d10: \SystemRoot\System32\apisetschema.dll:
  60. 318.d10: CreationTime: 2009-07-13T23:18:54.866423200Z
  61. 318.d10: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  62. 318.d10: ChangeTime: 2018-05-18T11:04:54.522187200Z
  63. 318.d10: FileAttributes: 0x20
  64. 318.d10: Size: 0x1a00
  65. 318.d10: NT Headers: 0xc0
  66. 318.d10: Timestamp: 0x4a5bdeab
  67. 318.d10: Machine: 0x8664 - amd64
  68. 318.d10: Timestamp: 0x4a5bdeab
  69. 318.d10: Image Version: 6.1
  70. 318.d10: SizeOfImage: 0x50000 (327680)
  71. 318.d10: Resource Dir: 0x30000 LB 0x3f0
  72. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 318.d10: [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  74. 318.d10: ProductName: Microsoft® Windows® Operating System
  75. 318.d10: ProductVersion: 6.1.7600.16385
  76. 318.d10: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  77. 318.d10: FileDescription: ApiSet Schema DLL
  78. 318.d10: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 318.d10: supR3HardenedWinFindAdversaries: 0x4
  80. 318.d10: \SystemRoot\System32\drivers\aswHwid.sys:
  81. 318.d10: CreationTime: 2018-05-18T13:33:42.817801200Z
  82. 318.d10: LastWriteTime: 2018-06-24T17:30:43.603950000Z
  83. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  84. 318.d10: FileAttributes: 0x20
  85. 318.d10: Size: 0xb780
  86. 318.d10: NT Headers: 0xf0
  87. 318.d10: Timestamp: 0x5b1f767e
  88. 318.d10: Machine: 0x8664 - amd64
  89. 318.d10: Timestamp: 0x5b1f767e
  90. 318.d10: Image Version: 6.0
  91. 318.d10: SizeOfImage: 0xa000 (40960)
  92. 318.d10: Resource Dir: 0x8000 LB 0x388
  93. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  94. 318.d10: [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  95. 318.d10: ProductName: Avast Antivirus
  96. 318.d10: ProductVersion: 18.5.3926.0
  97. 318.d10: FileVersion: 18.5.3926.0
  98. 318.d10: FileDescription: Avast HWID
  99. 318.d10: \SystemRoot\System32\drivers\aswMonFlt.sys:
  100. 318.d10: CreationTime: 2018-05-18T13:33:43.067401700Z
  101. 318.d10: LastWriteTime: 2018-06-24T17:30:43.667350100Z
  102. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  103. 318.d10: FileAttributes: 0x20
  104. 318.d10: Size: 0x26f98
  105. 318.d10: NT Headers: 0xe8
  106. 318.d10: Timestamp: 0x5b1f75f5
  107. 318.d10: Machine: 0x8664 - amd64
  108. 318.d10: Timestamp: 0x5b1f75f5
  109. 318.d10: Image Version: 6.0
  110. 318.d10: SizeOfImage: 0x2b000 (176128)
  111. 318.d10: Resource Dir: 0x29000 LB 0x3b0
  112. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  113. 318.d10: [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  114. 318.d10: ProductName: Avast Antivirus
  115. 318.d10: ProductVersion: 18.5.3926.0
  116. 318.d10: FileVersion: 18.5.3926.0
  117. 318.d10: FileDescription: Avast File System Minifilter for Windows 2003/Vista
  118. 318.d10: \SystemRoot\System32\drivers\aswRdr2.sys:
  119. 318.d10: CreationTime: 2018-05-18T13:33:42.209400200Z
  120. 318.d10: LastWriteTime: 2018-06-24T17:30:43.039348800Z
  121. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  122. 318.d10: FileAttributes: 0x20
  123. 318.d10: Size: 0x1b500
  124. 318.d10: NT Headers: 0xe8
  125. 318.d10: Timestamp: 0x5b1f762c
  126. 318.d10: Machine: 0x8664 - amd64
  127. 318.d10: Timestamp: 0x5b1f762c
  128. 318.d10: Image Version: 6.1
  129. 318.d10: SizeOfImage: 0x1a000 (106496)
  130. 318.d10: Resource Dir: 0x18000 LB 0x398
  131. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  132. 318.d10: [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  133. 318.d10: ProductName: Avast Antivirus
  134. 318.d10: ProductVersion: 18.5.3926.0
  135. 318.d10: FileVersion: 18.5.3926.0 built by: WinDDK
  136. 318.d10: FileDescription: Avast WFP Redirect Driver
  137. 318.d10: \SystemRoot\System32\drivers\aswRvrt.sys:
  138. 318.d10: CreationTime: 2018-05-18T13:33:43.317002100Z
  139. 318.d10: LastWriteTime: 2018-06-24T17:30:43.729750200Z
  140. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  141. 318.d10: FileAttributes: 0x20
  142. 318.d10: Size: 0x14fd0
  143. 318.d10: NT Headers: 0xf0
  144. 318.d10: Timestamp: 0x5b1f761a
  145. 318.d10: Machine: 0x8664 - amd64
  146. 318.d10: Timestamp: 0x5b1f761a
  147. 318.d10: Image Version: 6.0
  148. 318.d10: SizeOfImage: 0x14000 (81920)
  149. 318.d10: Resource Dir: 0x12000 LB 0x388
  150. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  151. 318.d10: [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  152. 318.d10: ProductName: Avast Antivirus
  153. 318.d10: ProductVersion: 18.5.3926.0
  154. 318.d10: FileVersion: 18.5.3926.0
  155. 318.d10: FileDescription: Avast Revert
  156. 318.d10: \SystemRoot\System32\drivers\aswSnx.sys:
  157. 318.d10: CreationTime: 2018-05-18T13:33:41.554199000Z
  158. 318.d10: LastWriteTime: 2018-06-24T17:30:24.084108500Z
  159. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  160. 318.d10: FileAttributes: 0x20
  161. 318.d10: Size: 0xfae90
  162. 318.d10: NT Headers: 0xf0
  163. 318.d10: Timestamp: 0x5b1f764b
  164. 318.d10: Machine: 0x8664 - amd64
  165. 318.d10: Timestamp: 0x5b1f764b
  166. 318.d10: Image Version: 6.0
  167. 318.d10: SizeOfImage: 0xf8000 (1015808)
  168. 318.d10: Resource Dir: 0xf0000 LB 0x378
  169. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  170. 318.d10: [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  171. 318.d10: ProductName: Avast Antivirus
  172. 318.d10: ProductVersion: 18.5.3926.0
  173. 318.d10: FileVersion: 18.5.3926.0
  174. 318.d10: FileDescription: Avast Virtualization Driver
  175. 318.d10: \SystemRoot\System32\drivers\aswsp.sys:
  176. 318.d10: CreationTime: 2018-05-18T13:33:43.769402900Z
  177. 318.d10: LastWriteTime: 2018-07-23T15:04:03.246072700Z
  178. 318.d10: ChangeTime: 2018-07-23T15:04:03.246072700Z
  179. 318.d10: FileAttributes: 0x20
  180. 318.d10: Size: 0x72078
  181. 318.d10: NT Headers: 0xe0
  182. 318.d10: Timestamp: 0x5b4789fa
  183. 318.d10: Machine: 0x8664 - amd64
  184. 318.d10: Timestamp: 0x5b4789fa
  185. 318.d10: Image Version: 6.1
  186. 318.d10: SizeOfImage: 0x72000 (466944)
  187. 318.d10: Resource Dir: 0x70000 LB 0x378
  188. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  189. 318.d10: [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  190. 318.d10: ProductName: Avast Antivirus
  191. 318.d10: ProductVersion: 18.5.3931.340
  192. 318.d10: FileVersion: 18.5.3931.340
  193. 318.d10: FileDescription: Avast self protection module
  194. 318.d10: \SystemRoot\System32\drivers\aswStm.sys:
  195. 318.d10: CreationTime: 2018-05-18T13:33:44.284203800Z
  196. 318.d10: LastWriteTime: 2018-06-24T17:30:44.232951300Z
  197. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  198. 318.d10: FileAttributes: 0x20
  199. 318.d10: Size: 0x338d8
  200. 318.d10: NT Headers: 0x110
  201. 318.d10: Timestamp: 0x5b1f768b
  202. 318.d10: Machine: 0x8664 - amd64
  203. 318.d10: Timestamp: 0x5b1f768b
  204. 318.d10: Image Version: 10.0
  205. 318.d10: SizeOfImage: 0x34000 (212992)
  206. 318.d10: Resource Dir: 0x32000 LB 0x350
  207. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  208. 318.d10: [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  209. 318.d10: ProductName: Avast Antivirus
  210. 318.d10: ProductVersion: 18.5.3926.0
  211. 318.d10: FileVersion: 18.5.3926.0
  212. 318.d10: FileDescription: Stream Filter
  213. 318.d10: \SystemRoot\System32\drivers\aswVmm.sys:
  214. 318.d10: CreationTime: 2018-05-18T13:33:44.050203400Z
  215. 318.d10: LastWriteTime: 2018-06-24T17:30:43.871150500Z
  216. 318.d10: ChangeTime: 2018-06-24T17:30:52.499569200Z
  217. 318.d10: FileAttributes: 0x20
  218. 318.d10: Size: 0x5d290
  219. 318.d10: NT Headers: 0xe8
  220. 318.d10: Timestamp: 0x5b1f761e
  221. 318.d10: Machine: 0x8664 - amd64
  222. 318.d10: Timestamp: 0x5b1f761e
  223. 318.d10: Image Version: 6.0
  224. 318.d10: SizeOfImage: 0x5b000 (372736)
  225. 318.d10: Resource Dir: 0x58000 LB 0x390
  226. 318.d10: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  227. 318.d10: [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  228. 318.d10: ProductName: Avast Antivirus
  229. 318.d10: ProductVersion: 18.5.3926.0
  230. 318.d10: FileVersion: 18.5.3926.0
  231. 318.d10: FileDescription: Avast VM Monitor
  232. 318.d10: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  233. 318.d10: Calling main()
  234. 318.d10: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  235. 318.d10: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  236. 318.d10: SUPR3HardenedMain: Respawn #1
  237. 318.d10: System32: \Device\HarddiskVolume2\Windows\System32
  238. 318.d10: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  239. 318.d10: KnownDllPath: C:\Windows\system32
  240. 318.d10: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  241. 318.d10: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  242. 318.d10: supR3HardNtEnableThreadCreation:
  243. 318.d10: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  244. 318.d10: supR3HardenedWinDoReSpawn(1): New child ad0.14d8 [kernel32].
  245. 318.d10: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380
  246. 318.d10: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076da0000 uNtDllChildAddr=0000000076da0000
  247. 318.d10: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076dcc320
  248. 318.d10: supR3HardenedWinSetupChildInit: Start child.
  249. 318.d10: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  250. 318.d10: supR3HardNtChildPurify: Startup delay kludge #1/0: 521 ms, 37 sleeps
  251. 318.d10: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  252. 318.d10: *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  253. 318.d10: *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  254. 318.d10: *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  255. 318.d10: 0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  256. 318.d10: *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  257. 318.d10: 0000000000041000-000000000007ffff 0x0001/0x0000 0x0000000
  258. 318.d10: *0000000000080000-000000000017bfff 0x0000/0x0004 0x0020000
  259. 318.d10: 000000000017c000-000000000017dfff 0x0104/0x0004 0x0020000
  260. 318.d10: 000000000017e000-000000000017ffff 0x0004/0x0004 0x0020000
  261. 318.d10: 0000000000180000-0000000076d9ffff 0x0001/0x0000 0x0000000
  262. 318.d10: *0000000076da0000-0000000076da0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  263. 318.d10: 0000000076da1000-0000000076ea2fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  264. 318.d10: 0000000076ea3000-0000000076ed1fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  265. 318.d10: 0000000076ed2000-0000000076eddfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  266. 318.d10: 0000000076ede000-0000000076f48fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  267. 318.d10: 0000000076f49000-000000007efdffff 0x0001/0x0000 0x0000000
  268. 318.d10: *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  269. 318.d10: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  270. 318.d10: 000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  271. 318.d10: 000000007fff0000-000000013ff8ffff 0x0001/0x0000 0x0000000
  272. 318.d10: *000000013ff90000-000000013ff90fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  273. 318.d10: 000000013ff91000-0000000140001fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  274. 318.d10: 0000000140002000-0000000140002fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  275. 318.d10: 0000000140003000-0000000140048fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  276. 318.d10: 0000000140049000-0000000140049fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  277. 318.d10: 000000014004a000-000000014004afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  278. 318.d10: 000000014004b000-000000014004ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  279. 318.d10: 0000000140050000-0000000140050fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  280. 318.d10: 0000000140051000-0000000140051fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  281. 318.d10: 0000000140052000-0000000140055fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  282. 318.d10: 0000000140056000-000000014009dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  283. 318.d10: 000000014009e000-000007feff0bffff 0x0001/0x0000 0x0000000
  284. 318.d10: *000007feff0c0000-000007feff0c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  285. 318.d10: 000007feff0c1000-000007fffffaffff 0x0001/0x0000 0x0000000
  286. 318.d10: *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  287. 318.d10: 000007fffffd3000-000007fffffdcfff 0x0001/0x0000 0x0000000
  288. 318.d10: *000007fffffdd000-000007fffffdefff 0x0004/0x0004 0x0020000
  289. 318.d10: *000007fffffdf000-000007fffffdffff 0x0004/0x0004 0x0020000
  290. 318.d10: *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  291. 318.d10: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  292. 318.d10: VirtualBox.exe: timestamp 0x5b4cb14e (rc=VINF_SUCCESS)
  293. 318.d10: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  294. 318.d10: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  295. 318.d10: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  296. 318.d10: supR3HardNtChildPurify: Done after 553 ms and 0 fixes (loop #0).
  297. ad0.14d8: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  298. ad0.14d8: supR3HardenedVmProcessInit: uNtDllAddr=0000000076da0000 g_uNtVerCombined=0x611db100
  299. 318.d10: supR3HardNtEnableThreadCreation:
  300. ad0.14d8: ntdll.dll: timestamp 0x4ce7c8f9 (rc=VINF_SUCCESS)
  301. ad0.14d8: New simple heap: #1 0000000000280000 LB 0x400000 (for 1740800 allocation)
  302. ad0.14d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  303. ad0.14d8: System32: \Device\HarddiskVolume2\Windows\System32
  304. ad0.14d8: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  305. ad0.14d8: KnownDllPath: C:\Windows\system32
  306. ad0.14d8: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  307. ad0.14d8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  308. ad0.14d8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  309. ad0.14d8: Registered Dll notification callback with NTDLL.
  310. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  311. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  312. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  313. ad0.14d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  314. ad0.14d8: supR3HardenedDllNotificationCallback: load 0000000076b80000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  315. ad0.14d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  316. ad0.14d8: supR3HardenedDllNotificationCallback: load 000007fefcfb0000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  317. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  318. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  319. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  320. ad0.14d8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  321. 318.d10: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 31 ms.
  322. ad0.14d8: \SystemRoot\System32\ntdll.dll:
  323. ad0.14d8: CreationTime: 2010-11-21T03:23:51.351694200Z
  324. ad0.14d8: LastWriteTime: 2010-11-21T03:23:51.367294200Z
  325. ad0.14d8: ChangeTime: 2018-05-18T11:05:42.819872000Z
  326. ad0.14d8: FileAttributes: 0x20
  327. ad0.14d8: Size: 0x1a6d60
  328. ad0.14d8: NT Headers: 0xe0
  329. ad0.14d8: Timestamp: 0x4ce7c8f9
  330. ad0.14d8: Machine: 0x8664 - amd64
  331. ad0.14d8: Timestamp: 0x4ce7c8f9
  332. ad0.14d8: Image Version: 6.1
  333. ad0.14d8: SizeOfImage: 0x1a9000 (1740800)
  334. ad0.14d8: Resource Dir: 0x151000 LB 0x560d8
  335. ad0.14d8: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  336. ad0.14d8: [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  337. ad0.14d8: ProductName: Microsoft® Windows® Operating System
  338. ad0.14d8: ProductVersion: 6.1.7601.17514
  339. ad0.14d8: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  340. ad0.14d8: FileDescription: NT Layer DLL
  341. ad0.14d8: \SystemRoot\System32\kernel32.dll:
  342. ad0.14d8: CreationTime: 2010-11-21T03:24:07.965723400Z
  343. ad0.14d8: LastWriteTime: 2010-11-21T03:24:07.981323400Z
  344. ad0.14d8: ChangeTime: 2018-05-18T11:05:14.739822700Z
  345. ad0.14d8: FileAttributes: 0x20
  346. ad0.14d8: Size: 0x11b800
  347. ad0.14d8: NT Headers: 0xe8
  348. ad0.14d8: Timestamp: 0x4ce7c78b
  349. ad0.14d8: Machine: 0x8664 - amd64
  350. ad0.14d8: Timestamp: 0x4ce7c78b
  351. ad0.14d8: Image Version: 6.1
  352. ad0.14d8: SizeOfImage: 0x11f000 (1175552)
  353. ad0.14d8: Resource Dir: 0x116000 LB 0x528
  354. ad0.14d8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  355. ad0.14d8: [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  356. ad0.14d8: ProductName: Microsoft® Windows® Operating System
  357. ad0.14d8: ProductVersion: 6.1.7601.17514
  358. ad0.14d8: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  359. ad0.14d8: FileDescription: Windows NT BASE API Client DLL
  360. ad0.14d8: \SystemRoot\System32\KernelBase.dll:
  361. ad0.14d8: CreationTime: 2010-11-21T03:24:26.217755400Z
  362. ad0.14d8: LastWriteTime: 2010-11-21T03:24:26.248955500Z
  363. ad0.14d8: ChangeTime: 2018-05-18T11:05:14.755422700Z
  364. ad0.14d8: FileAttributes: 0x20
  365. ad0.14d8: Size: 0x66800
  366. ad0.14d8: NT Headers: 0xf0
  367. ad0.14d8: Timestamp: 0x4ce7c78c
  368. ad0.14d8: Machine: 0x8664 - amd64
  369. ad0.14d8: Timestamp: 0x4ce7c78c
  370. ad0.14d8: Image Version: 6.1
  371. ad0.14d8: SizeOfImage: 0x6b000 (438272)
  372. ad0.14d8: Resource Dir: 0x69000 LB 0x530
  373. ad0.14d8: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  374. ad0.14d8: [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  375. ad0.14d8: ProductName: Microsoft® Windows® Operating System
  376. ad0.14d8: ProductVersion: 6.1.7601.17514
  377. ad0.14d8: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  378. ad0.14d8: FileDescription: Windows NT BASE API Client DLL
  379. ad0.14d8: \SystemRoot\System32\apisetschema.dll:
  380. ad0.14d8: CreationTime: 2009-07-13T23:18:54.866423200Z
  381. ad0.14d8: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  382. ad0.14d8: ChangeTime: 2018-05-18T11:04:54.522187200Z
  383. ad0.14d8: FileAttributes: 0x20
  384. ad0.14d8: Size: 0x1a00
  385. ad0.14d8: NT Headers: 0xc0
  386. ad0.14d8: Timestamp: 0x4a5bdeab
  387. ad0.14d8: Machine: 0x8664 - amd64
  388. ad0.14d8: Timestamp: 0x4a5bdeab
  389. ad0.14d8: Image Version: 6.1
  390. ad0.14d8: SizeOfImage: 0x50000 (327680)
  391. ad0.14d8: Resource Dir: 0x30000 LB 0x3f0
  392. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  393. ad0.14d8: [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  394. ad0.14d8: ProductName: Microsoft® Windows® Operating System
  395. ad0.14d8: ProductVersion: 6.1.7600.16385
  396. ad0.14d8: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  397. ad0.14d8: FileDescription: ApiSet Schema DLL
  398. ad0.14d8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  399. ad0.14d8: supR3HardenedWinFindAdversaries: 0x4
  400. ad0.14d8: \SystemRoot\System32\drivers\aswHwid.sys:
  401. ad0.14d8: CreationTime: 2018-05-18T13:33:42.817801200Z
  402. ad0.14d8: LastWriteTime: 2018-06-24T17:30:43.603950000Z
  403. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  404. ad0.14d8: FileAttributes: 0x20
  405. ad0.14d8: Size: 0xb780
  406. ad0.14d8: NT Headers: 0xf0
  407. ad0.14d8: Timestamp: 0x5b1f767e
  408. ad0.14d8: Machine: 0x8664 - amd64
  409. ad0.14d8: Timestamp: 0x5b1f767e
  410. ad0.14d8: Image Version: 6.0
  411. ad0.14d8: SizeOfImage: 0xa000 (40960)
  412. ad0.14d8: Resource Dir: 0x8000 LB 0x388
  413. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  414. ad0.14d8: [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  415. ad0.14d8: ProductName: Avast Antivirus
  416. ad0.14d8: ProductVersion: 18.5.3926.0
  417. ad0.14d8: FileVersion: 18.5.3926.0
  418. ad0.14d8: FileDescription: Avast HWID
  419. ad0.14d8: \SystemRoot\System32\drivers\aswMonFlt.sys:
  420. ad0.14d8: CreationTime: 2018-05-18T13:33:43.067401700Z
  421. ad0.14d8: LastWriteTime: 2018-06-24T17:30:43.667350100Z
  422. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  423. ad0.14d8: FileAttributes: 0x20
  424. ad0.14d8: Size: 0x26f98
  425. ad0.14d8: NT Headers: 0xe8
  426. ad0.14d8: Timestamp: 0x5b1f75f5
  427. ad0.14d8: Machine: 0x8664 - amd64
  428. ad0.14d8: Timestamp: 0x5b1f75f5
  429. ad0.14d8: Image Version: 6.0
  430. ad0.14d8: SizeOfImage: 0x2b000 (176128)
  431. ad0.14d8: Resource Dir: 0x29000 LB 0x3b0
  432. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  433. ad0.14d8: [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  434. ad0.14d8: ProductName: Avast Antivirus
  435. ad0.14d8: ProductVersion: 18.5.3926.0
  436. ad0.14d8: FileVersion: 18.5.3926.0
  437. ad0.14d8: FileDescription: Avast File System Minifilter for Windows 2003/Vista
  438. ad0.14d8: \SystemRoot\System32\drivers\aswRdr2.sys:
  439. ad0.14d8: CreationTime: 2018-05-18T13:33:42.209400200Z
  440. ad0.14d8: LastWriteTime: 2018-06-24T17:30:43.039348800Z
  441. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  442. ad0.14d8: FileAttributes: 0x20
  443. ad0.14d8: Size: 0x1b500
  444. ad0.14d8: NT Headers: 0xe8
  445. ad0.14d8: Timestamp: 0x5b1f762c
  446. ad0.14d8: Machine: 0x8664 - amd64
  447. ad0.14d8: Timestamp: 0x5b1f762c
  448. ad0.14d8: Image Version: 6.1
  449. ad0.14d8: SizeOfImage: 0x1a000 (106496)
  450. ad0.14d8: Resource Dir: 0x18000 LB 0x398
  451. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  452. ad0.14d8: [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  453. ad0.14d8: ProductName: Avast Antivirus
  454. ad0.14d8: ProductVersion: 18.5.3926.0
  455. ad0.14d8: FileVersion: 18.5.3926.0 built by: WinDDK
  456. ad0.14d8: FileDescription: Avast WFP Redirect Driver
  457. ad0.14d8: \SystemRoot\System32\drivers\aswRvrt.sys:
  458. ad0.14d8: CreationTime: 2018-05-18T13:33:43.317002100Z
  459. ad0.14d8: LastWriteTime: 2018-06-24T17:30:43.729750200Z
  460. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  461. ad0.14d8: FileAttributes: 0x20
  462. ad0.14d8: Size: 0x14fd0
  463. ad0.14d8: NT Headers: 0xf0
  464. ad0.14d8: Timestamp: 0x5b1f761a
  465. ad0.14d8: Machine: 0x8664 - amd64
  466. ad0.14d8: Timestamp: 0x5b1f761a
  467. ad0.14d8: Image Version: 6.0
  468. ad0.14d8: SizeOfImage: 0x14000 (81920)
  469. ad0.14d8: Resource Dir: 0x12000 LB 0x388
  470. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  471. ad0.14d8: [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  472. ad0.14d8: ProductName: Avast Antivirus
  473. ad0.14d8: ProductVersion: 18.5.3926.0
  474. ad0.14d8: FileVersion: 18.5.3926.0
  475. ad0.14d8: FileDescription: Avast Revert
  476. ad0.14d8: \SystemRoot\System32\drivers\aswSnx.sys:
  477. ad0.14d8: CreationTime: 2018-05-18T13:33:41.554199000Z
  478. ad0.14d8: LastWriteTime: 2018-06-24T17:30:24.084108500Z
  479. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  480. ad0.14d8: FileAttributes: 0x20
  481. ad0.14d8: Size: 0xfae90
  482. ad0.14d8: NT Headers: 0xf0
  483. ad0.14d8: Timestamp: 0x5b1f764b
  484. ad0.14d8: Machine: 0x8664 - amd64
  485. ad0.14d8: Timestamp: 0x5b1f764b
  486. ad0.14d8: Image Version: 6.0
  487. ad0.14d8: SizeOfImage: 0xf8000 (1015808)
  488. ad0.14d8: Resource Dir: 0xf0000 LB 0x378
  489. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  490. ad0.14d8: [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  491. ad0.14d8: ProductName: Avast Antivirus
  492. ad0.14d8: ProductVersion: 18.5.3926.0
  493. ad0.14d8: FileVersion: 18.5.3926.0
  494. ad0.14d8: FileDescription: Avast Virtualization Driver
  495. ad0.14d8: \SystemRoot\System32\drivers\aswsp.sys:
  496. ad0.14d8: CreationTime: 2018-05-18T13:33:43.769402900Z
  497. ad0.14d8: LastWriteTime: 2018-07-23T15:04:03.246072700Z
  498. ad0.14d8: ChangeTime: 2018-07-23T15:04:03.246072700Z
  499. ad0.14d8: FileAttributes: 0x20
  500. ad0.14d8: Size: 0x72078
  501. ad0.14d8: NT Headers: 0xe0
  502. ad0.14d8: Timestamp: 0x5b4789fa
  503. ad0.14d8: Machine: 0x8664 - amd64
  504. ad0.14d8: Timestamp: 0x5b4789fa
  505. ad0.14d8: Image Version: 6.1
  506. ad0.14d8: SizeOfImage: 0x72000 (466944)
  507. ad0.14d8: Resource Dir: 0x70000 LB 0x378
  508. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  509. ad0.14d8: [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  510. ad0.14d8: ProductName: Avast Antivirus
  511. ad0.14d8: ProductVersion: 18.5.3931.340
  512. ad0.14d8: FileVersion: 18.5.3931.340
  513. ad0.14d8: FileDescription: Avast self protection module
  514. ad0.14d8: \SystemRoot\System32\drivers\aswStm.sys:
  515. ad0.14d8: CreationTime: 2018-05-18T13:33:44.284203800Z
  516. ad0.14d8: LastWriteTime: 2018-06-24T17:30:44.232951300Z
  517. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  518. ad0.14d8: FileAttributes: 0x20
  519. ad0.14d8: Size: 0x338d8
  520. ad0.14d8: NT Headers: 0x110
  521. ad0.14d8: Timestamp: 0x5b1f768b
  522. ad0.14d8: Machine: 0x8664 - amd64
  523. ad0.14d8: Timestamp: 0x5b1f768b
  524. ad0.14d8: Image Version: 10.0
  525. ad0.14d8: SizeOfImage: 0x34000 (212992)
  526. ad0.14d8: Resource Dir: 0x32000 LB 0x350
  527. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  528. ad0.14d8: [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  529. ad0.14d8: ProductName: Avast Antivirus
  530. ad0.14d8: ProductVersion: 18.5.3926.0
  531. ad0.14d8: FileVersion: 18.5.3926.0
  532. ad0.14d8: FileDescription: Stream Filter
  533. ad0.14d8: \SystemRoot\System32\drivers\aswVmm.sys:
  534. ad0.14d8: CreationTime: 2018-05-18T13:33:44.050203400Z
  535. ad0.14d8: LastWriteTime: 2018-06-24T17:30:43.871150500Z
  536. ad0.14d8: ChangeTime: 2018-06-24T17:30:52.499569200Z
  537. ad0.14d8: FileAttributes: 0x20
  538. ad0.14d8: Size: 0x5d290
  539. ad0.14d8: NT Headers: 0xe8
  540. ad0.14d8: Timestamp: 0x5b1f761e
  541. ad0.14d8: Machine: 0x8664 - amd64
  542. ad0.14d8: Timestamp: 0x5b1f761e
  543. ad0.14d8: Image Version: 6.0
  544. ad0.14d8: SizeOfImage: 0x5b000 (372736)
  545. ad0.14d8: Resource Dir: 0x58000 LB 0x390
  546. ad0.14d8: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  547. ad0.14d8: [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  548. ad0.14d8: ProductName: Avast Antivirus
  549. ad0.14d8: ProductVersion: 18.5.3926.0
  550. ad0.14d8: FileVersion: 18.5.3926.0
  551. ad0.14d8: FileDescription: Avast VM Monitor
  552. ad0.14d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  553. ad0.14d8: Calling main()
  554. ad0.14d8: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  555. ad0.14d8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  556. ad0.14d8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  557. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  558. ad0.14d8: SUPR3HardenedMain: Respawn #2
  559. ad0.14d8: supR3HardNtEnableThreadCreation:
  560. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
  561. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  562. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  563. ad0.14d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  564. ad0.14d8: supR3HardenedDllNotificationCallback: load 000007fefcb80000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
  565. ad0.14d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  566. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcb80000 'C:\Windows\system32\apphelp.dll'
  567. ad0.14d8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  568. ad0.14d8: supR3HardenedWinDoReSpawn(2): New child 810.300 [kernel32].
  569. ad0.14d8: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd9000 cbPeb=0x380
  570. ad0.14d8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076da0000 uNtDllChildAddr=0000000076da0000
  571. ad0.14d8: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076dcc320
  572. ad0.14d8: supR3HardenedWinSetupChildInit: Start child.
  573. ad0.14d8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  574. ad0.14d8: supR3HardNtChildPurify: Startup delay kludge #1/0: 528 ms, 57 sleeps
  575. ad0.14d8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  576. ad0.14d8: *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  577. ad0.14d8: *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  578. ad0.14d8: *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  579. ad0.14d8: 0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  580. ad0.14d8: *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  581. ad0.14d8: 0000000000041000-000000000016ffff 0x0001/0x0000 0x0000000
  582. ad0.14d8: *0000000000170000-000000000026bfff 0x0000/0x0004 0x0020000
  583. ad0.14d8: 000000000026c000-000000000026dfff 0x0104/0x0004 0x0020000
  584. ad0.14d8: 000000000026e000-000000000026ffff 0x0004/0x0004 0x0020000
  585. ad0.14d8: 0000000000270000-0000000076d9ffff 0x0001/0x0000 0x0000000
  586. ad0.14d8: *0000000076da0000-0000000076da0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  587. ad0.14d8: 0000000076da1000-0000000076ea2fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  588. ad0.14d8: 0000000076ea3000-0000000076ed1fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  589. ad0.14d8: 0000000076ed2000-0000000076eddfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  590. ad0.14d8: 0000000076ede000-0000000076f48fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  591. ad0.14d8: 0000000076f49000-000000007efdffff 0x0001/0x0000 0x0000000
  592. ad0.14d8: *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  593. ad0.14d8: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  594. ad0.14d8: 000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  595. ad0.14d8: 000000007fff0000-000000013ff8ffff 0x0001/0x0000 0x0000000
  596. ad0.14d8: *000000013ff90000-000000013ff90fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  597. ad0.14d8: 000000013ff91000-0000000140001fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  598. ad0.14d8: 0000000140002000-0000000140002fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  599. ad0.14d8: 0000000140003000-0000000140048fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  600. ad0.14d8: 0000000140049000-0000000140049fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  601. ad0.14d8: 000000014004a000-000000014004afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  602. ad0.14d8: 000000014004b000-000000014004ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  603. ad0.14d8: 0000000140050000-0000000140050fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  604. ad0.14d8: 0000000140051000-0000000140051fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  605. ad0.14d8: 0000000140052000-0000000140055fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  606. ad0.14d8: 0000000140056000-000000014009dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  607. ad0.14d8: 000000014009e000-000007feff0bffff 0x0001/0x0000 0x0000000
  608. ad0.14d8: *000007feff0c0000-000007feff0c0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  609. ad0.14d8: 000007feff0c1000-000007fffffaffff 0x0001/0x0000 0x0000000
  610. ad0.14d8: *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  611. ad0.14d8: 000007fffffd3000-000007fffffd8fff 0x0001/0x0000 0x0000000
  612. ad0.14d8: *000007fffffd9000-000007fffffd9fff 0x0004/0x0004 0x0020000
  613. ad0.14d8: 000007fffffda000-000007fffffddfff 0x0001/0x0000 0x0000000
  614. ad0.14d8: *000007fffffde000-000007fffffdffff 0x0004/0x0004 0x0020000
  615. ad0.14d8: *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  616. ad0.14d8: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  617. ad0.14d8: VirtualBox.exe: timestamp 0x5b4cb14e (rc=VINF_SUCCESS)
  618. ad0.14d8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  619. ad0.14d8: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  620. ad0.14d8: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  621. ad0.14d8: supR3HardNtChildPurify: Done after 543 ms and 0 fixes (loop #0).
  622. 810.300: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  623. 810.300: supR3HardenedVmProcessInit: uNtDllAddr=0000000076da0000 g_uNtVerCombined=0x611db100
  624. ad0.14d8: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000280000 LB 0x400000)
  625. 810.300: ntdll.dll: timestamp 0x4ce7c8f9 (rc=VINF_SUCCESS)
  626. 810.300: New simple heap: #1 0000000000270000 LB 0x400000 (for 1740800 allocation)
  627. ad0.14d8: supR3HardNtEnableThreadCreation:
  628. 810.300: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  629. 810.300: System32: \Device\HarddiskVolume2\Windows\System32
  630. 810.300: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
  631. 810.300: KnownDllPath: C:\Windows\system32
  632. 810.300: supR3HardenedVmProcessInit: Opening vboxdrv...
  633. 810.300: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  634. 810.300: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  635. 810.300: Registered Dll notification callback with NTDLL.
  636. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  637. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  638. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  639. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  640. 810.300: supR3HardenedDllNotificationCallback: load 0000000076b80000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  641. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  642. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcfb0000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  643. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  644. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  645. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  646. 810.300: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  647. ad0.14d8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 47 ms.
  648. 810.300: \SystemRoot\System32\ntdll.dll:
  649. 810.300: CreationTime: 2010-11-21T03:23:51.351694200Z
  650. 810.300: LastWriteTime: 2010-11-21T03:23:51.367294200Z
  651. 810.300: ChangeTime: 2018-05-18T11:05:42.819872000Z
  652. 810.300: FileAttributes: 0x20
  653. 810.300: Size: 0x1a6d60
  654. 810.300: NT Headers: 0xe0
  655. 810.300: Timestamp: 0x4ce7c8f9
  656. 810.300: Machine: 0x8664 - amd64
  657. 810.300: Timestamp: 0x4ce7c8f9
  658. 810.300: Image Version: 6.1
  659. 810.300: SizeOfImage: 0x1a9000 (1740800)
  660. 810.300: Resource Dir: 0x151000 LB 0x560d8
  661. 810.300: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  662. 810.300: [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  663. 810.300: ProductName: Microsoft® Windows® Operating System
  664. 810.300: ProductVersion: 6.1.7601.17514
  665. 810.300: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  666. 810.300: FileDescription: NT Layer DLL
  667. 810.300: \SystemRoot\System32\kernel32.dll:
  668. 810.300: CreationTime: 2010-11-21T03:24:07.965723400Z
  669. 810.300: LastWriteTime: 2010-11-21T03:24:07.981323400Z
  670. 810.300: ChangeTime: 2018-05-18T11:05:14.739822700Z
  671. 810.300: FileAttributes: 0x20
  672. 810.300: Size: 0x11b800
  673. 810.300: NT Headers: 0xe8
  674. 810.300: Timestamp: 0x4ce7c78b
  675. 810.300: Machine: 0x8664 - amd64
  676. 810.300: Timestamp: 0x4ce7c78b
  677. 810.300: Image Version: 6.1
  678. 810.300: SizeOfImage: 0x11f000 (1175552)
  679. 810.300: Resource Dir: 0x116000 LB 0x528
  680. 810.300: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  681. 810.300: [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  682. 810.300: ProductName: Microsoft® Windows® Operating System
  683. 810.300: ProductVersion: 6.1.7601.17514
  684. 810.300: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  685. 810.300: FileDescription: Windows NT BASE API Client DLL
  686. 810.300: \SystemRoot\System32\KernelBase.dll:
  687. 810.300: CreationTime: 2010-11-21T03:24:26.217755400Z
  688. 810.300: LastWriteTime: 2010-11-21T03:24:26.248955500Z
  689. 810.300: ChangeTime: 2018-05-18T11:05:14.755422700Z
  690. 810.300: FileAttributes: 0x20
  691. 810.300: Size: 0x66800
  692. 810.300: NT Headers: 0xf0
  693. 810.300: Timestamp: 0x4ce7c78c
  694. 810.300: Machine: 0x8664 - amd64
  695. 810.300: Timestamp: 0x4ce7c78c
  696. 810.300: Image Version: 6.1
  697. 810.300: SizeOfImage: 0x6b000 (438272)
  698. 810.300: Resource Dir: 0x69000 LB 0x530
  699. 810.300: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  700. 810.300: [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  701. 810.300: ProductName: Microsoft® Windows® Operating System
  702. 810.300: ProductVersion: 6.1.7601.17514
  703. 810.300: FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  704. 810.300: FileDescription: Windows NT BASE API Client DLL
  705. 810.300: \SystemRoot\System32\apisetschema.dll:
  706. 810.300: CreationTime: 2009-07-13T23:18:54.866423200Z
  707. 810.300: LastWriteTime: 2009-07-14T01:24:53.779000000Z
  708. 810.300: ChangeTime: 2018-05-18T11:04:54.522187200Z
  709. 810.300: FileAttributes: 0x20
  710. 810.300: Size: 0x1a00
  711. 810.300: NT Headers: 0xc0
  712. 810.300: Timestamp: 0x4a5bdeab
  713. 810.300: Machine: 0x8664 - amd64
  714. 810.300: Timestamp: 0x4a5bdeab
  715. 810.300: Image Version: 6.1
  716. 810.300: SizeOfImage: 0x50000 (327680)
  717. 810.300: Resource Dir: 0x30000 LB 0x3f0
  718. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  719. 810.300: [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  720. 810.300: ProductName: Microsoft® Windows® Operating System
  721. 810.300: ProductVersion: 6.1.7600.16385
  722. 810.300: FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
  723. 810.300: FileDescription: ApiSet Schema DLL
  724. 810.300: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  725. 810.300: supR3HardenedWinFindAdversaries: 0x4
  726. 810.300: \SystemRoot\System32\drivers\aswHwid.sys:
  727. 810.300: CreationTime: 2018-05-18T13:33:42.817801200Z
  728. 810.300: LastWriteTime: 2018-06-24T17:30:43.603950000Z
  729. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  730. 810.300: FileAttributes: 0x20
  731. 810.300: Size: 0xb780
  732. 810.300: NT Headers: 0xf0
  733. 810.300: Timestamp: 0x5b1f767e
  734. 810.300: Machine: 0x8664 - amd64
  735. 810.300: Timestamp: 0x5b1f767e
  736. 810.300: Image Version: 6.0
  737. 810.300: SizeOfImage: 0xa000 (40960)
  738. 810.300: Resource Dir: 0x8000 LB 0x388
  739. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  740. 810.300: [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  741. 810.300: ProductName: Avast Antivirus
  742. 810.300: ProductVersion: 18.5.3926.0
  743. 810.300: FileVersion: 18.5.3926.0
  744. 810.300: FileDescription: Avast HWID
  745. 810.300: \SystemRoot\System32\drivers\aswMonFlt.sys:
  746. 810.300: CreationTime: 2018-05-18T13:33:43.067401700Z
  747. 810.300: LastWriteTime: 2018-06-24T17:30:43.667350100Z
  748. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  749. 810.300: FileAttributes: 0x20
  750. 810.300: Size: 0x26f98
  751. 810.300: NT Headers: 0xe8
  752. 810.300: Timestamp: 0x5b1f75f5
  753. 810.300: Machine: 0x8664 - amd64
  754. 810.300: Timestamp: 0x5b1f75f5
  755. 810.300: Image Version: 6.0
  756. 810.300: SizeOfImage: 0x2b000 (176128)
  757. 810.300: Resource Dir: 0x29000 LB 0x3b0
  758. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  759. 810.300: [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  760. 810.300: ProductName: Avast Antivirus
  761. 810.300: ProductVersion: 18.5.3926.0
  762. 810.300: FileVersion: 18.5.3926.0
  763. 810.300: FileDescription: Avast File System Minifilter for Windows 2003/Vista
  764. 810.300: \SystemRoot\System32\drivers\aswRdr2.sys:
  765. 810.300: CreationTime: 2018-05-18T13:33:42.209400200Z
  766. 810.300: LastWriteTime: 2018-06-24T17:30:43.039348800Z
  767. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  768. 810.300: FileAttributes: 0x20
  769. 810.300: Size: 0x1b500
  770. 810.300: NT Headers: 0xe8
  771. 810.300: Timestamp: 0x5b1f762c
  772. 810.300: Machine: 0x8664 - amd64
  773. 810.300: Timestamp: 0x5b1f762c
  774. 810.300: Image Version: 6.1
  775. 810.300: SizeOfImage: 0x1a000 (106496)
  776. 810.300: Resource Dir: 0x18000 LB 0x398
  777. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  778. 810.300: [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  779. 810.300: ProductName: Avast Antivirus
  780. 810.300: ProductVersion: 18.5.3926.0
  781. 810.300: FileVersion: 18.5.3926.0 built by: WinDDK
  782. 810.300: FileDescription: Avast WFP Redirect Driver
  783. 810.300: \SystemRoot\System32\drivers\aswRvrt.sys:
  784. 810.300: CreationTime: 2018-05-18T13:33:43.317002100Z
  785. 810.300: LastWriteTime: 2018-06-24T17:30:43.729750200Z
  786. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  787. 810.300: FileAttributes: 0x20
  788. 810.300: Size: 0x14fd0
  789. 810.300: NT Headers: 0xf0
  790. 810.300: Timestamp: 0x5b1f761a
  791. 810.300: Machine: 0x8664 - amd64
  792. 810.300: Timestamp: 0x5b1f761a
  793. 810.300: Image Version: 6.0
  794. 810.300: SizeOfImage: 0x14000 (81920)
  795. 810.300: Resource Dir: 0x12000 LB 0x388
  796. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  797. 810.300: [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  798. 810.300: ProductName: Avast Antivirus
  799. 810.300: ProductVersion: 18.5.3926.0
  800. 810.300: FileVersion: 18.5.3926.0
  801. 810.300: FileDescription: Avast Revert
  802. 810.300: \SystemRoot\System32\drivers\aswSnx.sys:
  803. 810.300: CreationTime: 2018-05-18T13:33:41.554199000Z
  804. 810.300: LastWriteTime: 2018-06-24T17:30:24.084108500Z
  805. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  806. 810.300: FileAttributes: 0x20
  807. 810.300: Size: 0xfae90
  808. 810.300: NT Headers: 0xf0
  809. 810.300: Timestamp: 0x5b1f764b
  810. 810.300: Machine: 0x8664 - amd64
  811. 810.300: Timestamp: 0x5b1f764b
  812. 810.300: Image Version: 6.0
  813. 810.300: SizeOfImage: 0xf8000 (1015808)
  814. 810.300: Resource Dir: 0xf0000 LB 0x378
  815. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  816. 810.300: [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  817. 810.300: ProductName: Avast Antivirus
  818. 810.300: ProductVersion: 18.5.3926.0
  819. 810.300: FileVersion: 18.5.3926.0
  820. 810.300: FileDescription: Avast Virtualization Driver
  821. 810.300: \SystemRoot\System32\drivers\aswsp.sys:
  822. 810.300: CreationTime: 2018-05-18T13:33:43.769402900Z
  823. 810.300: LastWriteTime: 2018-07-23T15:04:03.246072700Z
  824. 810.300: ChangeTime: 2018-07-23T15:04:03.246072700Z
  825. 810.300: FileAttributes: 0x20
  826. 810.300: Size: 0x72078
  827. 810.300: NT Headers: 0xe0
  828. 810.300: Timestamp: 0x5b4789fa
  829. 810.300: Machine: 0x8664 - amd64
  830. 810.300: Timestamp: 0x5b4789fa
  831. 810.300: Image Version: 6.1
  832. 810.300: SizeOfImage: 0x72000 (466944)
  833. 810.300: Resource Dir: 0x70000 LB 0x378
  834. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  835. 810.300: [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  836. 810.300: ProductName: Avast Antivirus
  837. 810.300: ProductVersion: 18.5.3931.340
  838. 810.300: FileVersion: 18.5.3931.340
  839. 810.300: FileDescription: Avast self protection module
  840. 810.300: \SystemRoot\System32\drivers\aswStm.sys:
  841. 810.300: CreationTime: 2018-05-18T13:33:44.284203800Z
  842. 810.300: LastWriteTime: 2018-06-24T17:30:44.232951300Z
  843. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  844. 810.300: FileAttributes: 0x20
  845. 810.300: Size: 0x338d8
  846. 810.300: NT Headers: 0x110
  847. 810.300: Timestamp: 0x5b1f768b
  848. 810.300: Machine: 0x8664 - amd64
  849. 810.300: Timestamp: 0x5b1f768b
  850. 810.300: Image Version: 10.0
  851. 810.300: SizeOfImage: 0x34000 (212992)
  852. 810.300: Resource Dir: 0x32000 LB 0x350
  853. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  854. 810.300: [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  855. 810.300: ProductName: Avast Antivirus
  856. 810.300: ProductVersion: 18.5.3926.0
  857. 810.300: FileVersion: 18.5.3926.0
  858. 810.300: FileDescription: Stream Filter
  859. 810.300: \SystemRoot\System32\drivers\aswVmm.sys:
  860. 810.300: CreationTime: 2018-05-18T13:33:44.050203400Z
  861. 810.300: LastWriteTime: 2018-06-24T17:30:43.871150500Z
  862. 810.300: ChangeTime: 2018-06-24T17:30:52.499569200Z
  863. 810.300: FileAttributes: 0x20
  864. 810.300: Size: 0x5d290
  865. 810.300: NT Headers: 0xe8
  866. 810.300: Timestamp: 0x5b1f761e
  867. 810.300: Machine: 0x8664 - amd64
  868. 810.300: Timestamp: 0x5b1f761e
  869. 810.300: Image Version: 6.0
  870. 810.300: SizeOfImage: 0x5b000 (372736)
  871. 810.300: Resource Dir: 0x58000 LB 0x390
  872. 810.300: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  873. 810.300: [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  874. 810.300: ProductName: Avast Antivirus
  875. 810.300: ProductVersion: 18.5.3926.0
  876. 810.300: FileVersion: 18.5.3926.0
  877. 810.300: FileDescription: Avast VM Monitor
  878. 810.300: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  879. 810.300: Calling main()
  880. 810.300: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  881. 810.300: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  882. 810.300: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  883. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  884. 810.300: SUPR3HardenedMain: Final process, opening VBoxDrv...
  885. 810.300: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000270000 LB 0x400000)
  886. 810.300: supR3HardNtEnableThreadCreation:
  887. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  888. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  889. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  890. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  891. 810.300: supR3HardenedDllNotificationCallback: load 000007fef48a0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  892. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  893. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  894. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  895. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  896. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  897. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  898. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  899. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  900. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  901. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
  902. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  903. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  904. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
  905. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  906. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  907. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  908. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
  909. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  910. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  911. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  912. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
  913. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
  914. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  915. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  916. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  917. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  918. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
  919. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  920. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  921. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  922. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
  923. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  924. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  925. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  926. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  927. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  928. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  929. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  930. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  931. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  932. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcf10000 LB 0x0003a000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
  933. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  934. 810.300: supR3HardenedDllNotificationCallback: load 000007fefdb50000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
  935. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  936. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcda0000 LB 0x00167000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
  937. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  938. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcd90000 LB 0x0000f000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
  939. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  940. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd770000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  941. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  942. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\Wintrust.dll'
  943. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
  944. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  945. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  946. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  947. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc6d0000 LB 0x00022000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
  948. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  949. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6d0000 'C:\Windows\system32\bcrypt.dll'
  950. 810.300: bcrypt.dll loaded at 000007fefc6d0000, BCryptOpenAlgorithmProvider at 000007fefc6d2640, preloading providers:
  951. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  952. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
  953. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
  954. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
  955. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  956. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  957. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  958. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  959. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  960. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  961. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  962. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
  963. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  964. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  965. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  966. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  967. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  968. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  969. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  970. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  971. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  972. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc1c0000 LB 0x0004c000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
  973. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  974. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd0d0000 LB 0x000db000 C:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
  975. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  976. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  977. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  978. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
  979. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
  980. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd510000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  981. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  982. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc1c0000 'C:\Windows\system32\bcryptprimitives.dll'
  983. 810.300: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=000000000080aaf0)
  984. 810.300: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=000000000080d9b0)
  985. 810.300: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=000000000080dad0)
  986. 810.300: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=000000000080dce0)
  987. 810.300: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=000000000080de00)
  988. 810.300: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=000000000080df20)
  989. 810.300: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=000000000080e160)
  990. 810.300: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=000000000080e280)
  991. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
  992. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  993. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  994. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  995. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  996. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  997. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  998. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  999. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1000. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1001. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc580000 LB 0x00017000 C:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
  1002. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1003. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc580000 'C:\Windows\system32\CRYPTSP.dll'
  1004. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1005. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
  1006. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
  1007. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1008. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1009. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1010. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1011. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1012. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc280000 LB 0x00047000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
  1013. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1014. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc280000 'C:\Windows\system32\rsaenh.dll'
  1015. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1016. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1017. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  1018. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
  1019. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1020. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1021. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  1022. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcbe0000 LB 0x0000f000 C:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
  1023. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  1024. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\CRYPTBASE.dll'
  1025. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  1026. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1027. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  1028. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  1029. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1030. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\WINTRUST.DLL'
  1031. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1032. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1033. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\CRYPT32.dll'
  1034. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1035. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
  1036. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1037. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1038. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1039. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1040. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imagehlp.dll (Input=imagehlp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1041. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1042. 810.300: supR3HardenedDllNotificationCallback: load 000007fefee30000 LB 0x00017000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
  1043. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1044. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefee30000 'C:\Windows\system32\imagehlp.dll'
  1045. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1046. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1047. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc580000 'C:\Windows\system32\CRYPTSP.dll'
  1048. 810.300: \Device\HarddiskVolume2\Windows\System32\user32.dll: Owner is administrators group.
  1049. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1050. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
  1051. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
  1052. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1053. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1054. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1055. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
  1056. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
  1057. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1058. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
  1059. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume2\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
  1060. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1061. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1062. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
  1063. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\lpk.dll)
  1064. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\lpk.dll
  1065. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1066. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1067. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1068. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
  1069. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume2\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
  1070. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1071. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1072. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  1073. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\usp10.dll)
  1074. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\usp10.dll
  1075. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1076. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1077. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1078. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1079. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1080. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1081. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1082. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1083. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1084. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1085. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1086. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1087. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1088. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1089. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1090. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USER32.dll (Input=USER32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1091. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1092. 810.300: supR3HardenedDllNotificationCallback: load 0000000076ca0000 LB 0x000fa000 C:\Windows\system32\USER32.dll [fFlags=0x0]
  1093. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1094. 810.300: supR3HardenedDllNotificationCallback: load 000007fefe030000 LB 0x00067000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
  1095. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1096. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd530000 LB 0x0000e000 C:\Windows\system32\LPK.dll [fFlags=0x0]
  1097. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\lpk.dll [lacks WinVerifyTrust]
  1098. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd330000 LB 0x000c9000 C:\Windows\system32\USP10.dll [fFlags=0x0]
  1099. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\usp10.dll [lacks WinVerifyTrust]
  1100. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1101. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1102. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe030000 'C:\Windows\system32\gdi32.dll'
  1103. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1104. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1105. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
  1106. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
  1107. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
  1108. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
  1109. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
  1110. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1111. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1112. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  1113. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
  1114. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
  1115. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
  1116. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1117. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1118. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1119. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1120. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1121. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1122. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1123. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1124. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1125. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1126. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1127. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1128. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1129. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1130. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1131. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1132. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1133. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1134. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1135. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1136. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd6e0000 LB 0x0002e000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
  1137. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1138. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd400000 LB 0x00109000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
  1139. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [lacks WinVerifyTrust]
  1140. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6e0000 'C:\Windows\system32\IMM32.DLL'
  1141. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076ca0000 'C:\Windows\system32\USER32.dll'
  1142. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
  1143. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1144. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
  1145. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ncrypt.dll)
  1146. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1147. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  1148. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  1149. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  1150. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1151. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1152. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1153. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1154. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1155. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1156. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ncrypt.dll (Input=ncrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1157. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1158. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc700000 LB 0x0004e000 C:\Windows\system32\ncrypt.dll [fFlags=0x0]
  1159. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1160. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc700000 'C:\Windows\system32\ncrypt.dll'
  1161. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1162. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (Input=bcrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1163. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6d0000 'C:\Windows\system32\bcrypt.dll'
  1164. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1165. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  1166. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
  1167. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\userenv.dll)
  1168. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
  1169. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1170. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1171. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1172. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
  1173. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
  1174. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1175. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1176. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1177. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1178. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1179. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1180. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1181. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1182. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1183. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USERENV.dll (Input=USERENV.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1184. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1185. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc040000 LB 0x0001e000 C:\Windows\system32\USERENV.dll [fFlags=0x0]
  1186. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1187. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1188. 810.300: supR3HardenedDllNotificationCallback: load 000007fefccf0000 LB 0x0000f000 C:\Windows\system32\profapi.dll [fFlags=0x0]
  1189. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1190. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc040000 'C:\Windows\system32\USERENV.dll'
  1191. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1192. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1193. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1194. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1195. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1196. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1197. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1198. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1199. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
  1200. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1201. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1202. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1203. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1204. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1205. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1206. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1207. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\GPAPI.dll (Input=GPAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1208. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1209. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc020000 LB 0x0001b000 C:\Windows\system32\GPAPI.dll [fFlags=0x0]
  1210. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1211. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc020000 'C:\Windows\system32\GPAPI.dll'
  1212. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1213. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1214. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1215. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1216. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1217. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd770000 'C:\Windows\system32\rpcrt4.dll'
  1218. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1219. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1220. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L2-1-0.dll'
  1221. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1222. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1223. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1224. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1225. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'crypt32.dll'.
  1226. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'wldap32.dll'.
  1227. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
  1228. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1229. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
  1230. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
  1231. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1232. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\Wldap32.dll)
  1233. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1234. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  1235. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  1236. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1237. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1238. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1239. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1240. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1241. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1242. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1243. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1244. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1245. 810.300: supR3HardenedDllNotificationCallback: load 000007fef4790000 LB 0x00026000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
  1246. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1247. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd710000 LB 0x00052000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
  1248. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
  1249. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1250. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1251. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1252. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1253. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1254. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1255. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1256. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1257. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1258. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1259. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1260. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1261. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1262. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1263. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1264. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1265. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1266. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1267. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1268. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1269. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1270. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1271. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1272. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1273. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1274. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1275. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1276. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1277. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1278. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1279. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1280. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  1281. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
  1282. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1283. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1284. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1285. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1286. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1287. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1288. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1289. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1290. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1291. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1292. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHLWAPI.dll (Input=SHLWAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1293. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1294. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd660000 LB 0x00071000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
  1295. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1296. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd660000 'C:\Windows\system32\SHLWAPI.dll'
  1297. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1298. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1299. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1300. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1301. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1302. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccf0000 'C:\Windows\system32\profapi.dll'
  1303. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'cfgmgr32.dll'.
  1304. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcrt.dll'.
  1305. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
  1306. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1307. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1308. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  1309. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'devobj.dll'.
  1310. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll)
  1311. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1312. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  1313. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  1314. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1315. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'cfgmgr32.dll'.
  1316. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devobj.dll)
  1317. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
  1318. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1319. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1320. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1321. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1322. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1323. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1324. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1325. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll)
  1326. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1327. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1328. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1329. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1330. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1331. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1332. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1333. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1334. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1335. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1336. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1337. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1338. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1339. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1340. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1341. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1342. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
  1343. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1344. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll)
  1345. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1346. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1347. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1348. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1349. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1350. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1351. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1352. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1353. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1354. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1355. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1356. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1357. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1358. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1359. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1360. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1361. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1362. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1363. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1364. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1365. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1366. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1367. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1368. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1369. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1370. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1371. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
  1372. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1373. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ole32.dll)
  1374. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1375. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1376. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1377. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  1378. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1379. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1380. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1381. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1382. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1383. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1384. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1385. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1386. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1387. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1388. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1389. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1390. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1391. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1392. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1393. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\setupapi.dll (Input=setupapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1394. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  1395. 810.300: supR3HardenedDllNotificationCallback: load 000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [fFlags=0x0]
  1396. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  1397. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  1398. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  1399. 810.300: supR3HardenedDllNotificationCallback: load 000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  1400. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll [lacks WinVerifyTrust]
  1401. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  1402. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ole32.dll [lacks WinVerifyTrust]
  1403. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  1404. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [lacks WinVerifyTrust]
  1405. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1406. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1407. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  1408. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdbf0000 'C:\Windows\system32\setupapi.dll'
  1409. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1410. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cabinet.dll)
  1411. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1412. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1413. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1414. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1415. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Cabinet.dll (Input=Cabinet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1416. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1417. 810.300: supR3HardenedDllNotificationCallback: load 000007fef4770000 LB 0x0001b000 C:\Windows\system32\Cabinet.dll [fFlags=0x0]
  1418. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1419. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4770000 'C:\Windows\system32\Cabinet.dll'
  1420. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1421. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devrtl.dll)
  1422. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1423. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1424. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1425. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1426. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\DEVRTL.dll (Input=DEVRTL.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1427. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1428. 810.300: supR3HardenedDllNotificationCallback: load 000007fefc060000 LB 0x00012000 C:\Windows\system32\DEVRTL.dll [fFlags=0x0]
  1429. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1430. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc060000 'C:\Windows\system32\DEVRTL.dll'
  1431. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [flags=0x0]
  1432. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [flags=0x0]
  1433. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [flags=0x0]
  1434. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [flags=0x0]
  1435. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [flags=0x0]
  1436. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1437. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1438. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  1439. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008056a0
  1440. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1441. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6463B603CF12442718467D754A1EDC45CE1D6E7E
  1442. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1443. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1444. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1445. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1446. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1447. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1448. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1449. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1450. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
  1451. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1452. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1453. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  1454. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1455. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1456. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1457. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1458. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1459. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1460. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\SystemRoot\System32\ntdll.dll'
  1461. 810.300: g_pfnWinVerifyTrust=000007fefcf11010
  1462. 810.300: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  1463. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e0 pwszName=\Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1464. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1465. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1466. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=766DAE0DAEDFFD0DB96611658C619DD5922D2FEC
  1467. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1468. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1469. 810.300: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1470. 810.300: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  1471. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d4 pwszName=\Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1472. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1473. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1474. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E8D9B442D9CC38B2D0501106E104A42A4EE0B238
  1475. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1476. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1477. 810.300: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1478. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003ec pwszName=\Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1479. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1480. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1481. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=445E5B0E9F43B5D56A5B9C4BC3369E3D076ACA1A
  1482. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1483. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1484. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1485. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e0 pwszName=\Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1486. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1487. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1488. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5D1555851298EA005A2E9FEA027F5898BC240083
  1489. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1490. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1491. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1492. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a8 pwszName=\Device\HarddiskVolume2\Windows\System32\ole32.dll
  1493. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1494. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1495. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E64AE329BD5124592BC8CB0B327AA3B95DC65B7
  1496. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1497. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1498. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1499. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a4 pwszName=\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1500. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1501. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1502. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8F731777EFC4BC982C1E1467FBF29A74CC14D93A
  1503. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1504. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1505. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1506. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a0 pwszName=\Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1507. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1508. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1509. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=26A5C3FE898CBD66951D3BC65E742E0BE561E69B
  1510. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1511. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1512. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1513. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000039c pwszName=\Device\HarddiskVolume2\Windows\System32\devobj.dll
  1514. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1515. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1516. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B410A095222E69F0ECE7D66E4AC27A7125D2EB5A
  1517. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1518. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1519. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1520. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000398 pwszName=\Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1521. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1522. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1523. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1499C4FEA6E143F9BEC35B4FFA098917D3A6EBF2
  1524. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1525. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1526. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1527. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000038c pwszName=\Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1528. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1529. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1530. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB8D9C9D3E1FC95D01F9A984B16ED031BB40CD8
  1531. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1532. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1533. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1534. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000380 pwszName=\Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1535. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1536. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1537. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87E73086F2528CF31D3AD5F0D71E04F8B942D5D8
  1538. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1539. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1540. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1541. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000037c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1542. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1543. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1544. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CA2FE16E05087DA5C24DC5EB2EE8053CDA5DE9A9
  1545. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1546. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1547. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1548. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000258 pwszName=\Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1549. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1550. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1551. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=470795C189226F7BDB8E50F42104CC34488B9340
  1552. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1553. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1554. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1555. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c4 pwszName=\Device\HarddiskVolume2\Windows\System32\profapi.dll
  1556. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1557. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1558. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
  1559. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1560. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1561. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1562. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c0 pwszName=\Device\HarddiskVolume2\Windows\System32\userenv.dll
  1563. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1564. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1565. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3E1A2CC7367F751C19EBF4E6EDF5E9A10E47313
  1566. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1567. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1568. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1569. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001ac pwszName=\Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1570. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1571. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1572. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3D482C50075646C922DC6A66C97956C5060C361B
  1573. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1574. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1575. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1576. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000194 pwszName=\Device\HarddiskVolume2\Windows\System32\msctf.dll
  1577. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1578. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1579. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=803AF52F95A9EFDFDA06C595023831EE36ACD3A8
  1580. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1581. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1582. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1583. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000190 pwszName=\Device\HarddiskVolume2\Windows\System32\imm32.dll
  1584. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1585. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1586. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6EEE1AB3B6D79AFF857940FF5F51ED27698153EC
  1587. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1588. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1589. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1590. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000018c pwszName=\Device\HarddiskVolume2\Windows\System32\usp10.dll
  1591. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1592. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1593. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=97AE9B5B40144F2794F30A891013393C80D631A1
  1594. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1595. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1596. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1597. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000188 pwszName=\Device\HarddiskVolume2\Windows\System32\lpk.dll
  1598. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1599. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1600. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A42DFBB8A3A26D2178D79D34DA1CE275E2A0BE37
  1601. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1602. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1603. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1604. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000184 pwszName=\Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1605. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1606. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1607. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C8F7179D2AEB0FEB168A01D182223AC2D7B8F331
  1608. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1609. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1610. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1611. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000180 pwszName=\Device\HarddiskVolume2\Windows\System32\user32.dll
  1612. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1613. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1614. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1615. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1616. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008056a0
  1617. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1618. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1619. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1620. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1621. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: -22900 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
  1622. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1623. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1624. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1625. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AFE89CF1060867A10BD3963894BCDB4D3058F804
  1626. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1627. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1628. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1629. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000130 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1630. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1631. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1632. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A965CC5DB13A5FB23BBB1B6B5FA6D400DC49462F
  1633. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1634. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1635. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1636. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
  1637. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000012c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  1638. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1639. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1640. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=40667EDBA9045D4A4BE1D4844665D3B88F8CD0E0
  1641. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1642. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1643. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1644. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000120 pwszName=\Device\HarddiskVolume2\Windows\System32\sechost.dll
  1645. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1646. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1647. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3FA2A014BF360CDC0E203A174FFC9DC5343C5323
  1648. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1649. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1650. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1651. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000011c pwszName=\Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1652. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1653. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1654. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DBCDF817D89920EE3139FB7E090744EB36A4A21B
  1655. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1656. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1657. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1658. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
  1659. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  1660. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1661. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1662. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62E377A1F0AD0C2EDC0A73CB3EFF841FF18D00D2
  1663. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1664. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1665. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1666. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e4 pwszName=\Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1667. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1668. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1669. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DBEAC8C0FA88C88B540ACFE0683B1810C077AA53
  1670. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1671. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1672. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1673. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000dc pwszName=\Device\HarddiskVolume2\Windows\System32\msasn1.dll
  1674. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1675. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1676. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F2FF57DC30D774F93061607060DAA0DD15E39CCE
  1677. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1678. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1679. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1680. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d8 pwszName=\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1681. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1682. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1683. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BC4D9E909DFDD2EE8BA1A5C857D73D49EBE7952C
  1684. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1685. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1686. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1687. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1688. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  1689. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1690. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1691. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=06FEC3C858DB28D2F4BFBDA99AF14D4747A8C5D4
  1692. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1693. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1694. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1695. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume2\Windows\System32\kernel32.dll
  1696. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1697. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1698. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D7AE634A00F24BBD4AE27DEA9BCCCE222DE9897B
  1699. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1700. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1701. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1702. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1703. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1704. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\crypt32.dll'
  1705. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1706. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1707. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1708. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1709. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa7446a7757ff9500 OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root
  1710. 810.300: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=BZ, ST=Belize, L=Belize city, O=Disc Soft Ltd, CN=Disc Soft Ltd, Email=finpr@disc-soft.com
  1711. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1712. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1713. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1714. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  1715. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  1716. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1717. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1718. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  1719. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1720. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1721. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1722. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1723. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1724. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1725. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x802b3770cb00af00 C=EU, L=Madrid (see current address at www.camerfirma.com/address), SRN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008
  1726. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1727. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1728. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
  1729. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1730. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1731. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1732. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  1733. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1734. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1735. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  1736. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1737. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  1738. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1739. 810.300: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=33
  1740. 810.300: SUPR3HardenedMain: Load Runtime...
  1741. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1742. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1743. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  1744. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  1745. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  1746. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1747. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1748. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1749. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1750. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1751. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003dc pwszName=\Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1752. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1753. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1754. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3EF3BDC1E84DFA17EA056313214EE88EC3E66F79
  1755. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ws2_32.dll'
  1756. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1757. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1758. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1759. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
  1760. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll) WinVerifyTrust
  1761. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1762. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1763. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1764. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1765. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  1766. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1767. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1768. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1769. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  1770. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1771. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1772. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1773. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1774. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  1775. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  1776. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b4 pwszName=\Device\HarddiskVolume2\Windows\System32\nsi.dll
  1777. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1778. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1779. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AFD8538945F2D05BC1AF949B9B19B7D2D9FBBF8
  1780. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\nsi.dll'
  1781. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1782. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll) WinVerifyTrust
  1783. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1784. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1785. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1786. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1787. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1788. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1789. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1790. 810.300: supR3HardenedDllNotificationCallback: load 000007fee44f0000 LB 0x00595000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1791. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1792. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1793. 810.300: supR3HardenedDllNotificationCallback: load 000000006f300000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1794. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1795. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1796. 810.300: supR3HardenedDllNotificationCallback: load 000000006f260000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1797. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1798. 810.300: supR3HardenedDllNotificationCallback: load 000007feff060000 LB 0x0004d000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
  1799. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1800. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd0c0000 LB 0x00008000 C:\Windows\system32\NSI.dll [fFlags=0x0]
  1801. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1802. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1803. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1804. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1805. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1806. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1807. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1808. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1809. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1810. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1811. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1812. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1813. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1814. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1815. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1816. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1817. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1818. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1819. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1820. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1821. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1822. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1823. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1824. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1825. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1826. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1827. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1828. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1829. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1830. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1831. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1832. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1833. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1834. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1835. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1836. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1837. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1838. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1839. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1840. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1841. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1842. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1843. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1844. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1845. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1846. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1847. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1848. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1849. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1850. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1851. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1852. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1853. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\Wintrust.dll'
  1854. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1855. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1856. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\crypt32.dll'
  1857. 810.300: SUPR3HardenedMain: Load TrustedMain...
  1858. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1859. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1860. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  1861. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1862. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1863. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
  1864. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
  1865. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
  1866. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  1867. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1868. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  1869. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  1870. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  1871. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  1872. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
  1873. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll) WinVerifyTrust
  1874. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1875. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1876. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1877. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000043c pwszName=\Device\HarddiskVolume2\Windows\System32\winmm.dll
  1878. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1879. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1880. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82E2B2A7826F88BEB98FFF0540C9BDB0A12F001A
  1881. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\winmm.dll'
  1882. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1883. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1884. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1885. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll) WinVerifyTrust
  1886. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1887. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1888. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1889. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1890. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1891. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1892. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1893. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1894. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1895. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000424 pwszName=\Device\HarddiskVolume2\Windows\System32\shell32.dll
  1896. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1897. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1898. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FCF00DB9BBECF4126AB4076577BBA73C0F94BDF9
  1899. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shell32.dll'
  1900. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1901. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1902. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'shlwapi.dll'.
  1903. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
  1904. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
  1905. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll) WinVerifyTrust
  1906. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1907. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1908. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1909. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1910. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1911. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1912. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1913. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1914. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1915. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1916. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1917. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1918. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1919. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1920. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
  1921. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
  1922. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1923. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1924. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
  1925. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1926. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1927. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1928. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
  1929. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
  1930. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll) WinVerifyTrust
  1931. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1932. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1933. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1934. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1935. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1936. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1937. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1938. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1939. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1940. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1941. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  1942. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1943. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1944. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1945. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1946. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1947. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1948. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1949. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1950. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1951. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1952. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll) WinVerifyTrust
  1953. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1954. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1955. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1956. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1957. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1958. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1959. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1960. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1961. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1962. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1963. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1964. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll) WinVerifyTrust
  1965. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1966. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1967. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1968. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1969. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1970. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1971. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1972. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1973. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1974. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1975. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1976. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000044c pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1977. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1978. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1979. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=608AC397FCC42B9FBAE25CB8C25EAF4C19AA384D
  1980. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
  1981. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1982. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1983. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1984. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1985. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
  1986. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
  1987. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1988. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll) WinVerifyTrust
  1989. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1990. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1991. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1992. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
  1993. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
  1994. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000464 pwszName=\Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1995. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1996. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1997. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
  1998. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ddraw.dll'
  1999. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2000. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2001. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2002. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
  2003. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  2004. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  2005. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
  2006. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ddraw.dll) WinVerifyTrust
  2007. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2008. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  2009. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  2010. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000470 pwszName=\Device\HarddiskVolume2\Windows\System32\glu32.dll
  2011. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2012. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2013. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60E45AB914E06A11F44EA76C6EF750AF892F9EA2
  2014. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\glu32.dll'
  2015. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2016. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2017. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  2018. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2019. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\glu32.dll) WinVerifyTrust
  2020. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2021. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2022. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2023. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2024. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2025. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2026. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2027. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2028. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2029. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2030. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2031. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2032. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2033. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2034. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  2035. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  2036. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000450 pwszName=\Device\HarddiskVolume2\Windows\System32\mpr.dll
  2037. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2038. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2039. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84FE9BA047B24E7694C9E0C349B48B9FD5F925B
  2040. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\mpr.dll'
  2041. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2042. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mpr.dll) WinVerifyTrust
  2043. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2044. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2045. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2046. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  2047. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2048. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2049. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2050. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2051. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2052. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2053. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2054. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2055. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2056. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2057. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2058. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2059. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2060. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2061. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2062. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2063. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2064. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2065. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2066. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2067. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2068. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2069. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2070. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2071. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2072. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2073. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2074. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2075. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2076. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2077. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2078. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2079. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2080. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2081. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2082. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2083. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2084. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2085. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2086. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2087. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2088. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2089. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2090. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2091. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2092. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2093. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2094. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2095. 810.300: Error (rc=0):
  2096. 810.300: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=16 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2097. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2098. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2099. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2100. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2101. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2102. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  2103. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  2104. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000480 pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2105. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2106. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2107. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=66EE5BDFFA413AEA9E1FE7838A08646E94136DA5
  2108. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
  2109. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2110. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2111. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
  2112. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2113. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  2114. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
  2115. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2116. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll) WinVerifyTrust
  2117. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2118. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  2119. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  2120. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000046c pwszName=\Device\HarddiskVolume2\Windows\System32\winspool.drv
  2121. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2122. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2123. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C89A2ED7B99A056D78CA6BAC9CCAB8B1FF119A14
  2124. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\winspool.drv'
  2125. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2126. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2127. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  2128. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2129. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winspool.drv) WinVerifyTrust
  2130. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2131. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2132. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2133. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2134. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2135. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2136. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2137. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2138. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2139. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2140. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2141. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2142. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2143. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2144. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2145. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2146. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2147. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2148. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2149. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2150. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2151. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2152. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2153. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2154. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2155. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2156. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2157. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2158. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2159. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2160. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2161. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2162. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2163. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2164. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2165. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2166. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2167. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2168. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2169. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2170. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2171. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2172. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2173. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2174. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2175. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2176. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2177. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2178. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  2179. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  2180. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000488 pwszName=\Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2181. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2182. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2183. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4D3B2DA266DE92D9E1311E30C810160CDC5BD5AA
  2184. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
  2185. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2186. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2187. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2188. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2189. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll) WinVerifyTrust
  2190. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2191. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2192. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2193. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2194. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2195. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2196. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2197. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2198. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2199. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2200. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2201. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2202. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2203. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2204. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2205. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2206. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2207. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  2208. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  2209. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000494 pwszName=\Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2210. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2211. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2212. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B79EE7B5AD74EF51A849809202E043183A2C727E
  2213. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
  2214. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2215. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2216. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2217. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2218. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll) WinVerifyTrust
  2219. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2220. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2221. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2222. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2223. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2224. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2225. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
  2226. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
  2227. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000498 pwszName=\Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2228. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2229. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2230. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3FEC714D729F7CAEB9B7A25E2012B6A6E9007F5
  2231. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dciman32.dll'
  2232. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2233. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2234. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  2235. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2236. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dciman32.dll) WinVerifyTrust
  2237. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2238. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2239. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2240. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2241. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2242. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2243. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2244. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2245. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2246. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2247. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2248. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2249. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2250. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2251. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2252. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2253. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2254. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2255. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2256. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2257. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2258. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2259. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2260. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2261. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2262. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2263. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2264. 810.300: supR3HardenedDllNotificationCallback: load 000007fee3890000 LB 0x00a06000 C:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  2265. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2266. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2267. 810.300: supR3HardenedDllNotificationCallback: load 000007fee43d0000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [fFlags=0x0]
  2268. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2269. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2270. 810.300: supR3HardenedDllNotificationCallback: load 000007fee4c50000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [fFlags=0x0]
  2271. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2272. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2273. 810.300: supR3HardenedDllNotificationCallback: load 000007fee3790000 LB 0x000f1000 C:\Windows\system32\DDRAW.dll [fFlags=0x0]
  2274. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2275. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2276. 810.300: supR3HardenedDllNotificationCallback: load 000007fef0400000 LB 0x00008000 C:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
  2277. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2278. 810.300: supR3HardenedDllNotificationCallback: load 000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
  2279. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2280. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  2281. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2282. 810.300: supR3HardenedDllNotificationCallback: load 000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  2283. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2284. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  2285. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2286. 810.300: supR3HardenedDllNotificationCallback: load 000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  2287. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
  2288. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2289. 810.300: supR3HardenedDllNotificationCallback: load 000007fefadf0000 LB 0x00018000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
  2290. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2291. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2292. 810.300: supR3HardenedDllNotificationCallback: load 0000000063d70000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  2293. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2294. 810.300: supR3HardenedDllNotificationCallback: load 000007fefe0a0000 LB 0x00d88000 C:\Windows\system32\SHELL32.dll [fFlags=0x0]
  2295. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2296. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2297. 810.300: supR3HardenedDllNotificationCallback: load 000007fef8af0000 LB 0x00018000 C:\Windows\system32\MPR.dll [fFlags=0x0]
  2298. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2299. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2300. 810.300: supR3HardenedDllNotificationCallback: load 000007fee3190000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  2301. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2302. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2303. 810.300: supR3HardenedDllNotificationCallback: load 0000000063800000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  2304. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2305. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  2306. 810.300: supR3HardenedDllNotificationCallback: load 000007fee3130000 LB 0x00051000 C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll [fFlags=0x0]
  2307. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  2308. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2309. 810.300: supR3HardenedDllNotificationCallback: load 000007fef9130000 LB 0x00071000 C:\Windows\system32\WINSPOOL.DRV [fFlags=0x0]
  2310. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2311. 810.300: supR3HardenedDllNotificationCallback: load 000007fefd540000 LB 0x00097000 C:\Windows\system32\COMDLG32.dll [fFlags=0x0]
  2312. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2313. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2314. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2315. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2316. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll)
  2317. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll
  2318. 810.300: supR3HardenedDllNotificationCallback: load 000007fef91b0000 LB 0x000a0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32.dll [fFlags=0x0]
  2319. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll [avoiding WinVerifyTrust]
  2320. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2321. 810.300: supR3HardenedDllNotificationCallback: load 0000000064a10000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  2322. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2323. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2324. 810.300: supR3HardenedDllNotificationCallback: load 000007fef99b0000 LB 0x0003b000 C:\Windows\system32\WINMM.dll [fFlags=0x0]
  2325. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2326. 810.300: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll'.
  2327. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll' [rescheduled]
  2328. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  2329. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2330. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  2331. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2332. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2333. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2334. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2335. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2336. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2337. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2338. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2339. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6e0000 'C:\Windows\system32\imm32.dll'
  2340. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.DLL'
  2341. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2342. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptbase.dll (Input=cryptbase.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  2343. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\cryptbase.dll'
  2344. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee3890000 'C:\Program Files\Oracle\VirtualBox\VirtualBox.dll'
  2345. 810.300: SUPR3HardenedMain: Calling TrustedMain (000007fee38914f0)...
  2346. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2347. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2348. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd940000 'C:\Windows\system32\ole32.dll'
  2349. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  2350. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\profapi.dll
  2351. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2352. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccf0000 'C:\Windows\system32\profapi.dll'
  2353. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2354. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  2355. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  2356. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  2357. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  2358. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2359. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2360. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  2361. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  2362. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  2363. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  2364. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  2365. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2366. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2367. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2368. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2369. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2370. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2371. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2372. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2373. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2374. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2375. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2376. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2377. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2378. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2379. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2380. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2381. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2382. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2383. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2384. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2385. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2386. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2387. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2388. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2389. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2390. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2391. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2392. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2393. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2394. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2395. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2396. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2397. 810.300: supR3HardenedDllNotificationCallback: load 000007fee3000000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  2398. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2399. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee3000000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  2400. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2401. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2402. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\CRYPTBASE.dll'
  2403. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000528 pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2404. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2405. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2406. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=936D45CC7026757A151F62882B557DD75D5FCB21
  2407. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
  2408. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2409. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2410. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2411. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  2412. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll) WinVerifyTrust
  2413. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2414. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2415. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2416. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2417. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2418. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2419. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2420. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2421. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2422. 810.300: supR3HardenedDllNotificationCallback: load 000007fefb1d0000 LB 0x00056000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
  2423. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2424. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2425. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2426. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2427. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2428. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2429. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2430. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2431. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2432. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2433. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2434. ad0.14d8: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1170 ms, the end);
  2435. 318.d10: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1775 ms, the end);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!