SHARE
TWEET

Untitled

a guest Jul 26th, 2018 189 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 318.d10: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110
  2. 318.d10: \SystemRoot\System32\ntdll.dll:
  3. 318.d10:     CreationTime:    2010-11-21T03:23:51.351694200Z
  4. 318.d10:     LastWriteTime:   2010-11-21T03:23:51.367294200Z
  5. 318.d10:     ChangeTime:      2018-05-18T11:05:42.819872000Z
  6. 318.d10:     FileAttributes:  0x20
  7. 318.d10:     Size:            0x1a6d60
  8. 318.d10:     NT Headers:      0xe0
  9. 318.d10:     Timestamp:       0x4ce7c8f9
  10. 318.d10:     Machine:         0x8664 - amd64
  11. 318.d10:     Timestamp:       0x4ce7c8f9
  12. 318.d10:     Image Version:   6.1
  13. 318.d10:     SizeOfImage:     0x1a9000 (1740800)
  14. 318.d10:     Resource Dir:    0x151000 LB 0x560d8
  15. 318.d10:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  16. 318.d10:     [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  17. 318.d10:     ProductName:     Microsoft® Windows® Operating System
  18. 318.d10:     ProductVersion:  6.1.7601.17514
  19. 318.d10:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  20. 318.d10:     FileDescription: NT Layer DLL
  21. 318.d10: \SystemRoot\System32\kernel32.dll:
  22. 318.d10:     CreationTime:    2010-11-21T03:24:07.965723400Z
  23. 318.d10:     LastWriteTime:   2010-11-21T03:24:07.981323400Z
  24. 318.d10:     ChangeTime:      2018-05-18T11:05:14.739822700Z
  25. 318.d10:     FileAttributes:  0x20
  26. 318.d10:     Size:            0x11b800
  27. 318.d10:     NT Headers:      0xe8
  28. 318.d10:     Timestamp:       0x4ce7c78b
  29. 318.d10:     Machine:         0x8664 - amd64
  30. 318.d10:     Timestamp:       0x4ce7c78b
  31. 318.d10:     Image Version:   6.1
  32. 318.d10:     SizeOfImage:     0x11f000 (1175552)
  33. 318.d10:     Resource Dir:    0x116000 LB 0x528
  34. 318.d10:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  35. 318.d10:     [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  36. 318.d10:     ProductName:     Microsoft® Windows® Operating System
  37. 318.d10:     ProductVersion:  6.1.7601.17514
  38. 318.d10:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  39. 318.d10:     FileDescription: Windows NT BASE API Client DLL
  40. 318.d10: \SystemRoot\System32\KernelBase.dll:
  41. 318.d10:     CreationTime:    2010-11-21T03:24:26.217755400Z
  42. 318.d10:     LastWriteTime:   2010-11-21T03:24:26.248955500Z
  43. 318.d10:     ChangeTime:      2018-05-18T11:05:14.755422700Z
  44. 318.d10:     FileAttributes:  0x20
  45. 318.d10:     Size:            0x66800
  46. 318.d10:     NT Headers:      0xf0
  47. 318.d10:     Timestamp:       0x4ce7c78c
  48. 318.d10:     Machine:         0x8664 - amd64
  49. 318.d10:     Timestamp:       0x4ce7c78c
  50. 318.d10:     Image Version:   6.1
  51. 318.d10:     SizeOfImage:     0x6b000 (438272)
  52. 318.d10:     Resource Dir:    0x69000 LB 0x530
  53. 318.d10:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  54. 318.d10:     [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  55. 318.d10:     ProductName:     Microsoft® Windows® Operating System
  56. 318.d10:     ProductVersion:  6.1.7601.17514
  57. 318.d10:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  58. 318.d10:     FileDescription: Windows NT BASE API Client DLL
  59. 318.d10: \SystemRoot\System32\apisetschema.dll:
  60. 318.d10:     CreationTime:    2009-07-13T23:18:54.866423200Z
  61. 318.d10:     LastWriteTime:   2009-07-14T01:24:53.779000000Z
  62. 318.d10:     ChangeTime:      2018-05-18T11:04:54.522187200Z
  63. 318.d10:     FileAttributes:  0x20
  64. 318.d10:     Size:            0x1a00
  65. 318.d10:     NT Headers:      0xc0
  66. 318.d10:     Timestamp:       0x4a5bdeab
  67. 318.d10:     Machine:         0x8664 - amd64
  68. 318.d10:     Timestamp:       0x4a5bdeab
  69. 318.d10:     Image Version:   6.1
  70. 318.d10:     SizeOfImage:     0x50000 (327680)
  71. 318.d10:     Resource Dir:    0x30000 LB 0x3f0
  72. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  73. 318.d10:     [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  74. 318.d10:     ProductName:     Microsoft® Windows® Operating System
  75. 318.d10:     ProductVersion:  6.1.7600.16385
  76. 318.d10:     FileVersion:     6.1.7600.16385 (win7_rtm.090713-1255)
  77. 318.d10:     FileDescription: ApiSet Schema DLL
  78. 318.d10: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  79. 318.d10: supR3HardenedWinFindAdversaries: 0x4
  80. 318.d10: \SystemRoot\System32\drivers\aswHwid.sys:
  81. 318.d10:     CreationTime:    2018-05-18T13:33:42.817801200Z
  82. 318.d10:     LastWriteTime:   2018-06-24T17:30:43.603950000Z
  83. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  84. 318.d10:     FileAttributes:  0x20
  85. 318.d10:     Size:            0xb780
  86. 318.d10:     NT Headers:      0xf0
  87. 318.d10:     Timestamp:       0x5b1f767e
  88. 318.d10:     Machine:         0x8664 - amd64
  89. 318.d10:     Timestamp:       0x5b1f767e
  90. 318.d10:     Image Version:   6.0
  91. 318.d10:     SizeOfImage:     0xa000 (40960)
  92. 318.d10:     Resource Dir:    0x8000 LB 0x388
  93. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  94. 318.d10:     [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  95. 318.d10:     ProductName:     Avast Antivirus
  96. 318.d10:     ProductVersion:  18.5.3926.0
  97. 318.d10:     FileVersion:     18.5.3926.0
  98. 318.d10:     FileDescription: Avast HWID
  99. 318.d10: \SystemRoot\System32\drivers\aswMonFlt.sys:
  100. 318.d10:     CreationTime:    2018-05-18T13:33:43.067401700Z
  101. 318.d10:     LastWriteTime:   2018-06-24T17:30:43.667350100Z
  102. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  103. 318.d10:     FileAttributes:  0x20
  104. 318.d10:     Size:            0x26f98
  105. 318.d10:     NT Headers:      0xe8
  106. 318.d10:     Timestamp:       0x5b1f75f5
  107. 318.d10:     Machine:         0x8664 - amd64
  108. 318.d10:     Timestamp:       0x5b1f75f5
  109. 318.d10:     Image Version:   6.0
  110. 318.d10:     SizeOfImage:     0x2b000 (176128)
  111. 318.d10:     Resource Dir:    0x29000 LB 0x3b0
  112. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  113. 318.d10:     [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  114. 318.d10:     ProductName:     Avast Antivirus
  115. 318.d10:     ProductVersion:  18.5.3926.0
  116. 318.d10:     FileVersion:     18.5.3926.0
  117. 318.d10:     FileDescription: Avast File System Minifilter for Windows 2003/Vista
  118. 318.d10: \SystemRoot\System32\drivers\aswRdr2.sys:
  119. 318.d10:     CreationTime:    2018-05-18T13:33:42.209400200Z
  120. 318.d10:     LastWriteTime:   2018-06-24T17:30:43.039348800Z
  121. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  122. 318.d10:     FileAttributes:  0x20
  123. 318.d10:     Size:            0x1b500
  124. 318.d10:     NT Headers:      0xe8
  125. 318.d10:     Timestamp:       0x5b1f762c
  126. 318.d10:     Machine:         0x8664 - amd64
  127. 318.d10:     Timestamp:       0x5b1f762c
  128. 318.d10:     Image Version:   6.1
  129. 318.d10:     SizeOfImage:     0x1a000 (106496)
  130. 318.d10:     Resource Dir:    0x18000 LB 0x398
  131. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  132. 318.d10:     [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  133. 318.d10:     ProductName:     Avast Antivirus
  134. 318.d10:     ProductVersion:  18.5.3926.0
  135. 318.d10:     FileVersion:     18.5.3926.0 built by: WinDDK
  136. 318.d10:     FileDescription: Avast WFP Redirect Driver
  137. 318.d10: \SystemRoot\System32\drivers\aswRvrt.sys:
  138. 318.d10:     CreationTime:    2018-05-18T13:33:43.317002100Z
  139. 318.d10:     LastWriteTime:   2018-06-24T17:30:43.729750200Z
  140. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  141. 318.d10:     FileAttributes:  0x20
  142. 318.d10:     Size:            0x14fd0
  143. 318.d10:     NT Headers:      0xf0
  144. 318.d10:     Timestamp:       0x5b1f761a
  145. 318.d10:     Machine:         0x8664 - amd64
  146. 318.d10:     Timestamp:       0x5b1f761a
  147. 318.d10:     Image Version:   6.0
  148. 318.d10:     SizeOfImage:     0x14000 (81920)
  149. 318.d10:     Resource Dir:    0x12000 LB 0x388
  150. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  151. 318.d10:     [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  152. 318.d10:     ProductName:     Avast Antivirus
  153. 318.d10:     ProductVersion:  18.5.3926.0
  154. 318.d10:     FileVersion:     18.5.3926.0
  155. 318.d10:     FileDescription: Avast Revert
  156. 318.d10: \SystemRoot\System32\drivers\aswSnx.sys:
  157. 318.d10:     CreationTime:    2018-05-18T13:33:41.554199000Z
  158. 318.d10:     LastWriteTime:   2018-06-24T17:30:24.084108500Z
  159. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  160. 318.d10:     FileAttributes:  0x20
  161. 318.d10:     Size:            0xfae90
  162. 318.d10:     NT Headers:      0xf0
  163. 318.d10:     Timestamp:       0x5b1f764b
  164. 318.d10:     Machine:         0x8664 - amd64
  165. 318.d10:     Timestamp:       0x5b1f764b
  166. 318.d10:     Image Version:   6.0
  167. 318.d10:     SizeOfImage:     0xf8000 (1015808)
  168. 318.d10:     Resource Dir:    0xf0000 LB 0x378
  169. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  170. 318.d10:     [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  171. 318.d10:     ProductName:     Avast Antivirus
  172. 318.d10:     ProductVersion:  18.5.3926.0
  173. 318.d10:     FileVersion:     18.5.3926.0
  174. 318.d10:     FileDescription: Avast Virtualization Driver
  175. 318.d10: \SystemRoot\System32\drivers\aswsp.sys:
  176. 318.d10:     CreationTime:    2018-05-18T13:33:43.769402900Z
  177. 318.d10:     LastWriteTime:   2018-07-23T15:04:03.246072700Z
  178. 318.d10:     ChangeTime:      2018-07-23T15:04:03.246072700Z
  179. 318.d10:     FileAttributes:  0x20
  180. 318.d10:     Size:            0x72078
  181. 318.d10:     NT Headers:      0xe0
  182. 318.d10:     Timestamp:       0x5b4789fa
  183. 318.d10:     Machine:         0x8664 - amd64
  184. 318.d10:     Timestamp:       0x5b4789fa
  185. 318.d10:     Image Version:   6.1
  186. 318.d10:     SizeOfImage:     0x72000 (466944)
  187. 318.d10:     Resource Dir:    0x70000 LB 0x378
  188. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  189. 318.d10:     [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  190. 318.d10:     ProductName:     Avast Antivirus
  191. 318.d10:     ProductVersion:  18.5.3931.340
  192. 318.d10:     FileVersion:     18.5.3931.340
  193. 318.d10:     FileDescription: Avast self protection module
  194. 318.d10: \SystemRoot\System32\drivers\aswStm.sys:
  195. 318.d10:     CreationTime:    2018-05-18T13:33:44.284203800Z
  196. 318.d10:     LastWriteTime:   2018-06-24T17:30:44.232951300Z
  197. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  198. 318.d10:     FileAttributes:  0x20
  199. 318.d10:     Size:            0x338d8
  200. 318.d10:     NT Headers:      0x110
  201. 318.d10:     Timestamp:       0x5b1f768b
  202. 318.d10:     Machine:         0x8664 - amd64
  203. 318.d10:     Timestamp:       0x5b1f768b
  204. 318.d10:     Image Version:   10.0
  205. 318.d10:     SizeOfImage:     0x34000 (212992)
  206. 318.d10:     Resource Dir:    0x32000 LB 0x350
  207. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  208. 318.d10:     [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  209. 318.d10:     ProductName:     Avast Antivirus
  210. 318.d10:     ProductVersion:  18.5.3926.0
  211. 318.d10:     FileVersion:     18.5.3926.0
  212. 318.d10:     FileDescription: Stream Filter
  213. 318.d10: \SystemRoot\System32\drivers\aswVmm.sys:
  214. 318.d10:     CreationTime:    2018-05-18T13:33:44.050203400Z
  215. 318.d10:     LastWriteTime:   2018-06-24T17:30:43.871150500Z
  216. 318.d10:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  217. 318.d10:     FileAttributes:  0x20
  218. 318.d10:     Size:            0x5d290
  219. 318.d10:     NT Headers:      0xe8
  220. 318.d10:     Timestamp:       0x5b1f761e
  221. 318.d10:     Machine:         0x8664 - amd64
  222. 318.d10:     Timestamp:       0x5b1f761e
  223. 318.d10:     Image Version:   6.0
  224. 318.d10:     SizeOfImage:     0x5b000 (372736)
  225. 318.d10:     Resource Dir:    0x58000 LB 0x390
  226. 318.d10:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  227. 318.d10:     [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  228. 318.d10:     ProductName:     Avast Antivirus
  229. 318.d10:     ProductVersion:  18.5.3926.0
  230. 318.d10:     FileVersion:     18.5.3926.0
  231. 318.d10:     FileDescription: Avast VM Monitor
  232. 318.d10: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  233. 318.d10: Calling main()
  234. 318.d10: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  235. 318.d10: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  236. 318.d10: SUPR3HardenedMain: Respawn #1
  237. 318.d10: System32:  \Device\HarddiskVolume2\Windows\System32
  238. 318.d10: WinSxS:    \Device\HarddiskVolume2\Windows\winsxs
  239. 318.d10: KnownDllPath: C:\Windows\system32
  240. 318.d10: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  241. 318.d10: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  242. 318.d10: supR3HardNtEnableThreadCreation:
  243. 318.d10: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  244. 318.d10: supR3HardenedWinDoReSpawn(1): New child ad0.14d8 [kernel32].
  245. 318.d10: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380
  246. 318.d10: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076da0000 uNtDllChildAddr=0000000076da0000
  247. 318.d10: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076dcc320
  248. 318.d10: supR3HardenedWinSetupChildInit: Start child.
  249. 318.d10: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  250. 318.d10: supR3HardNtChildPurify: Startup delay kludge #1/0: 521 ms, 37 sleeps
  251. 318.d10: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  252. 318.d10:  *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  253. 318.d10:  *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  254. 318.d10:  *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  255. 318.d10:   0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  256. 318.d10:  *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  257. 318.d10:   0000000000041000-000000000007ffff 0x0001/0x0000 0x0000000
  258. 318.d10:  *0000000000080000-000000000017bfff 0x0000/0x0004 0x0020000
  259. 318.d10:   000000000017c000-000000000017dfff 0x0104/0x0004 0x0020000
  260. 318.d10:   000000000017e000-000000000017ffff 0x0004/0x0004 0x0020000
  261. 318.d10:   0000000000180000-0000000076d9ffff 0x0001/0x0000 0x0000000
  262. 318.d10:  *0000000076da0000-0000000076da0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  263. 318.d10:   0000000076da1000-0000000076ea2fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  264. 318.d10:   0000000076ea3000-0000000076ed1fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  265. 318.d10:   0000000076ed2000-0000000076eddfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  266. 318.d10:   0000000076ede000-0000000076f48fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  267. 318.d10:   0000000076f49000-000000007efdffff 0x0001/0x0000 0x0000000
  268. 318.d10:  *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  269. 318.d10:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  270. 318.d10:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  271. 318.d10:   000000007fff0000-000000013ff8ffff 0x0001/0x0000 0x0000000
  272. 318.d10:  *000000013ff90000-000000013ff90fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  273. 318.d10:   000000013ff91000-0000000140001fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  274. 318.d10:   0000000140002000-0000000140002fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  275. 318.d10:   0000000140003000-0000000140048fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  276. 318.d10:   0000000140049000-0000000140049fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  277. 318.d10:   000000014004a000-000000014004afff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  278. 318.d10:   000000014004b000-000000014004ffff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  279. 318.d10:   0000000140050000-0000000140050fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  280. 318.d10:   0000000140051000-0000000140051fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  281. 318.d10:   0000000140052000-0000000140055fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  282. 318.d10:   0000000140056000-000000014009dfff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  283. 318.d10:   000000014009e000-000007feff0bffff 0x0001/0x0000 0x0000000
  284. 318.d10:  *000007feff0c0000-000007feff0c0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  285. 318.d10:   000007feff0c1000-000007fffffaffff 0x0001/0x0000 0x0000000
  286. 318.d10:  *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  287. 318.d10:   000007fffffd3000-000007fffffdcfff 0x0001/0x0000 0x0000000
  288. 318.d10:  *000007fffffdd000-000007fffffdefff 0x0004/0x0004 0x0020000
  289. 318.d10:  *000007fffffdf000-000007fffffdffff 0x0004/0x0004 0x0020000
  290. 318.d10:  *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  291. 318.d10: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  292. 318.d10: VirtualBox.exe: timestamp 0x5b4cb14e (rc=VINF_SUCCESS)
  293. 318.d10: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  294. 318.d10: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  295. 318.d10: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  296. 318.d10: supR3HardNtChildPurify: Done after 553 ms and 0 fixes (loop #0).
  297. ad0.14d8: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  298. ad0.14d8: supR3HardenedVmProcessInit: uNtDllAddr=0000000076da0000 g_uNtVerCombined=0x611db100
  299. 318.d10: supR3HardNtEnableThreadCreation:
  300. ad0.14d8: ntdll.dll: timestamp 0x4ce7c8f9 (rc=VINF_SUCCESS)
  301. ad0.14d8: New simple heap: #1 0000000000280000 LB 0x400000 (for 1740800 allocation)
  302. ad0.14d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  303. ad0.14d8: System32:  \Device\HarddiskVolume2\Windows\System32
  304. ad0.14d8: WinSxS:    \Device\HarddiskVolume2\Windows\winsxs
  305. ad0.14d8: KnownDllPath: C:\Windows\system32
  306. ad0.14d8: supR3HardenedVmProcessInit: Opening vboxdrv stub...
  307. ad0.14d8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  308. ad0.14d8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  309. ad0.14d8: Registered Dll notification callback with NTDLL.
  310. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  311. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  312. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  313. ad0.14d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  314. ad0.14d8: supR3HardenedDllNotificationCallback: load   0000000076b80000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  315. ad0.14d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  316. ad0.14d8: supR3HardenedDllNotificationCallback: load   000007fefcfb0000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  317. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  318. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  319. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  320. ad0.14d8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  321. 318.d10: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 31 ms.
  322. ad0.14d8: \SystemRoot\System32\ntdll.dll:
  323. ad0.14d8:     CreationTime:    2010-11-21T03:23:51.351694200Z
  324. ad0.14d8:     LastWriteTime:   2010-11-21T03:23:51.367294200Z
  325. ad0.14d8:     ChangeTime:      2018-05-18T11:05:42.819872000Z
  326. ad0.14d8:     FileAttributes:  0x20
  327. ad0.14d8:     Size:            0x1a6d60
  328. ad0.14d8:     NT Headers:      0xe0
  329. ad0.14d8:     Timestamp:       0x4ce7c8f9
  330. ad0.14d8:     Machine:         0x8664 - amd64
  331. ad0.14d8:     Timestamp:       0x4ce7c8f9
  332. ad0.14d8:     Image Version:   6.1
  333. ad0.14d8:     SizeOfImage:     0x1a9000 (1740800)
  334. ad0.14d8:     Resource Dir:    0x151000 LB 0x560d8
  335. ad0.14d8:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  336. ad0.14d8:     [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  337. ad0.14d8:     ProductName:     Microsoft® Windows® Operating System
  338. ad0.14d8:     ProductVersion:  6.1.7601.17514
  339. ad0.14d8:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  340. ad0.14d8:     FileDescription: NT Layer DLL
  341. ad0.14d8: \SystemRoot\System32\kernel32.dll:
  342. ad0.14d8:     CreationTime:    2010-11-21T03:24:07.965723400Z
  343. ad0.14d8:     LastWriteTime:   2010-11-21T03:24:07.981323400Z
  344. ad0.14d8:     ChangeTime:      2018-05-18T11:05:14.739822700Z
  345. ad0.14d8:     FileAttributes:  0x20
  346. ad0.14d8:     Size:            0x11b800
  347. ad0.14d8:     NT Headers:      0xe8
  348. ad0.14d8:     Timestamp:       0x4ce7c78b
  349. ad0.14d8:     Machine:         0x8664 - amd64
  350. ad0.14d8:     Timestamp:       0x4ce7c78b
  351. ad0.14d8:     Image Version:   6.1
  352. ad0.14d8:     SizeOfImage:     0x11f000 (1175552)
  353. ad0.14d8:     Resource Dir:    0x116000 LB 0x528
  354. ad0.14d8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  355. ad0.14d8:     [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  356. ad0.14d8:     ProductName:     Microsoft® Windows® Operating System
  357. ad0.14d8:     ProductVersion:  6.1.7601.17514
  358. ad0.14d8:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  359. ad0.14d8:     FileDescription: Windows NT BASE API Client DLL
  360. ad0.14d8: \SystemRoot\System32\KernelBase.dll:
  361. ad0.14d8:     CreationTime:    2010-11-21T03:24:26.217755400Z
  362. ad0.14d8:     LastWriteTime:   2010-11-21T03:24:26.248955500Z
  363. ad0.14d8:     ChangeTime:      2018-05-18T11:05:14.755422700Z
  364. ad0.14d8:     FileAttributes:  0x20
  365. ad0.14d8:     Size:            0x66800
  366. ad0.14d8:     NT Headers:      0xf0
  367. ad0.14d8:     Timestamp:       0x4ce7c78c
  368. ad0.14d8:     Machine:         0x8664 - amd64
  369. ad0.14d8:     Timestamp:       0x4ce7c78c
  370. ad0.14d8:     Image Version:   6.1
  371. ad0.14d8:     SizeOfImage:     0x6b000 (438272)
  372. ad0.14d8:     Resource Dir:    0x69000 LB 0x530
  373. ad0.14d8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  374. ad0.14d8:     [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  375. ad0.14d8:     ProductName:     Microsoft® Windows® Operating System
  376. ad0.14d8:     ProductVersion:  6.1.7601.17514
  377. ad0.14d8:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  378. ad0.14d8:     FileDescription: Windows NT BASE API Client DLL
  379. ad0.14d8: \SystemRoot\System32\apisetschema.dll:
  380. ad0.14d8:     CreationTime:    2009-07-13T23:18:54.866423200Z
  381. ad0.14d8:     LastWriteTime:   2009-07-14T01:24:53.779000000Z
  382. ad0.14d8:     ChangeTime:      2018-05-18T11:04:54.522187200Z
  383. ad0.14d8:     FileAttributes:  0x20
  384. ad0.14d8:     Size:            0x1a00
  385. ad0.14d8:     NT Headers:      0xc0
  386. ad0.14d8:     Timestamp:       0x4a5bdeab
  387. ad0.14d8:     Machine:         0x8664 - amd64
  388. ad0.14d8:     Timestamp:       0x4a5bdeab
  389. ad0.14d8:     Image Version:   6.1
  390. ad0.14d8:     SizeOfImage:     0x50000 (327680)
  391. ad0.14d8:     Resource Dir:    0x30000 LB 0x3f0
  392. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  393. ad0.14d8:     [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  394. ad0.14d8:     ProductName:     Microsoft® Windows® Operating System
  395. ad0.14d8:     ProductVersion:  6.1.7600.16385
  396. ad0.14d8:     FileVersion:     6.1.7600.16385 (win7_rtm.090713-1255)
  397. ad0.14d8:     FileDescription: ApiSet Schema DLL
  398. ad0.14d8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  399. ad0.14d8: supR3HardenedWinFindAdversaries: 0x4
  400. ad0.14d8: \SystemRoot\System32\drivers\aswHwid.sys:
  401. ad0.14d8:     CreationTime:    2018-05-18T13:33:42.817801200Z
  402. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:43.603950000Z
  403. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  404. ad0.14d8:     FileAttributes:  0x20
  405. ad0.14d8:     Size:            0xb780
  406. ad0.14d8:     NT Headers:      0xf0
  407. ad0.14d8:     Timestamp:       0x5b1f767e
  408. ad0.14d8:     Machine:         0x8664 - amd64
  409. ad0.14d8:     Timestamp:       0x5b1f767e
  410. ad0.14d8:     Image Version:   6.0
  411. ad0.14d8:     SizeOfImage:     0xa000 (40960)
  412. ad0.14d8:     Resource Dir:    0x8000 LB 0x388
  413. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  414. ad0.14d8:     [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  415. ad0.14d8:     ProductName:     Avast Antivirus
  416. ad0.14d8:     ProductVersion:  18.5.3926.0
  417. ad0.14d8:     FileVersion:     18.5.3926.0
  418. ad0.14d8:     FileDescription: Avast HWID
  419. ad0.14d8: \SystemRoot\System32\drivers\aswMonFlt.sys:
  420. ad0.14d8:     CreationTime:    2018-05-18T13:33:43.067401700Z
  421. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:43.667350100Z
  422. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  423. ad0.14d8:     FileAttributes:  0x20
  424. ad0.14d8:     Size:            0x26f98
  425. ad0.14d8:     NT Headers:      0xe8
  426. ad0.14d8:     Timestamp:       0x5b1f75f5
  427. ad0.14d8:     Machine:         0x8664 - amd64
  428. ad0.14d8:     Timestamp:       0x5b1f75f5
  429. ad0.14d8:     Image Version:   6.0
  430. ad0.14d8:     SizeOfImage:     0x2b000 (176128)
  431. ad0.14d8:     Resource Dir:    0x29000 LB 0x3b0
  432. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  433. ad0.14d8:     [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  434. ad0.14d8:     ProductName:     Avast Antivirus
  435. ad0.14d8:     ProductVersion:  18.5.3926.0
  436. ad0.14d8:     FileVersion:     18.5.3926.0
  437. ad0.14d8:     FileDescription: Avast File System Minifilter for Windows 2003/Vista
  438. ad0.14d8: \SystemRoot\System32\drivers\aswRdr2.sys:
  439. ad0.14d8:     CreationTime:    2018-05-18T13:33:42.209400200Z
  440. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:43.039348800Z
  441. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  442. ad0.14d8:     FileAttributes:  0x20
  443. ad0.14d8:     Size:            0x1b500
  444. ad0.14d8:     NT Headers:      0xe8
  445. ad0.14d8:     Timestamp:       0x5b1f762c
  446. ad0.14d8:     Machine:         0x8664 - amd64
  447. ad0.14d8:     Timestamp:       0x5b1f762c
  448. ad0.14d8:     Image Version:   6.1
  449. ad0.14d8:     SizeOfImage:     0x1a000 (106496)
  450. ad0.14d8:     Resource Dir:    0x18000 LB 0x398
  451. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  452. ad0.14d8:     [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  453. ad0.14d8:     ProductName:     Avast Antivirus
  454. ad0.14d8:     ProductVersion:  18.5.3926.0
  455. ad0.14d8:     FileVersion:     18.5.3926.0 built by: WinDDK
  456. ad0.14d8:     FileDescription: Avast WFP Redirect Driver
  457. ad0.14d8: \SystemRoot\System32\drivers\aswRvrt.sys:
  458. ad0.14d8:     CreationTime:    2018-05-18T13:33:43.317002100Z
  459. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:43.729750200Z
  460. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  461. ad0.14d8:     FileAttributes:  0x20
  462. ad0.14d8:     Size:            0x14fd0
  463. ad0.14d8:     NT Headers:      0xf0
  464. ad0.14d8:     Timestamp:       0x5b1f761a
  465. ad0.14d8:     Machine:         0x8664 - amd64
  466. ad0.14d8:     Timestamp:       0x5b1f761a
  467. ad0.14d8:     Image Version:   6.0
  468. ad0.14d8:     SizeOfImage:     0x14000 (81920)
  469. ad0.14d8:     Resource Dir:    0x12000 LB 0x388
  470. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  471. ad0.14d8:     [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  472. ad0.14d8:     ProductName:     Avast Antivirus
  473. ad0.14d8:     ProductVersion:  18.5.3926.0
  474. ad0.14d8:     FileVersion:     18.5.3926.0
  475. ad0.14d8:     FileDescription: Avast Revert
  476. ad0.14d8: \SystemRoot\System32\drivers\aswSnx.sys:
  477. ad0.14d8:     CreationTime:    2018-05-18T13:33:41.554199000Z
  478. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:24.084108500Z
  479. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  480. ad0.14d8:     FileAttributes:  0x20
  481. ad0.14d8:     Size:            0xfae90
  482. ad0.14d8:     NT Headers:      0xf0
  483. ad0.14d8:     Timestamp:       0x5b1f764b
  484. ad0.14d8:     Machine:         0x8664 - amd64
  485. ad0.14d8:     Timestamp:       0x5b1f764b
  486. ad0.14d8:     Image Version:   6.0
  487. ad0.14d8:     SizeOfImage:     0xf8000 (1015808)
  488. ad0.14d8:     Resource Dir:    0xf0000 LB 0x378
  489. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  490. ad0.14d8:     [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  491. ad0.14d8:     ProductName:     Avast Antivirus
  492. ad0.14d8:     ProductVersion:  18.5.3926.0
  493. ad0.14d8:     FileVersion:     18.5.3926.0
  494. ad0.14d8:     FileDescription: Avast Virtualization Driver
  495. ad0.14d8: \SystemRoot\System32\drivers\aswsp.sys:
  496. ad0.14d8:     CreationTime:    2018-05-18T13:33:43.769402900Z
  497. ad0.14d8:     LastWriteTime:   2018-07-23T15:04:03.246072700Z
  498. ad0.14d8:     ChangeTime:      2018-07-23T15:04:03.246072700Z
  499. ad0.14d8:     FileAttributes:  0x20
  500. ad0.14d8:     Size:            0x72078
  501. ad0.14d8:     NT Headers:      0xe0
  502. ad0.14d8:     Timestamp:       0x5b4789fa
  503. ad0.14d8:     Machine:         0x8664 - amd64
  504. ad0.14d8:     Timestamp:       0x5b4789fa
  505. ad0.14d8:     Image Version:   6.1
  506. ad0.14d8:     SizeOfImage:     0x72000 (466944)
  507. ad0.14d8:     Resource Dir:    0x70000 LB 0x378
  508. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  509. ad0.14d8:     [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  510. ad0.14d8:     ProductName:     Avast Antivirus
  511. ad0.14d8:     ProductVersion:  18.5.3931.340
  512. ad0.14d8:     FileVersion:     18.5.3931.340
  513. ad0.14d8:     FileDescription: Avast self protection module
  514. ad0.14d8: \SystemRoot\System32\drivers\aswStm.sys:
  515. ad0.14d8:     CreationTime:    2018-05-18T13:33:44.284203800Z
  516. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:44.232951300Z
  517. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  518. ad0.14d8:     FileAttributes:  0x20
  519. ad0.14d8:     Size:            0x338d8
  520. ad0.14d8:     NT Headers:      0x110
  521. ad0.14d8:     Timestamp:       0x5b1f768b
  522. ad0.14d8:     Machine:         0x8664 - amd64
  523. ad0.14d8:     Timestamp:       0x5b1f768b
  524. ad0.14d8:     Image Version:   10.0
  525. ad0.14d8:     SizeOfImage:     0x34000 (212992)
  526. ad0.14d8:     Resource Dir:    0x32000 LB 0x350
  527. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  528. ad0.14d8:     [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  529. ad0.14d8:     ProductName:     Avast Antivirus
  530. ad0.14d8:     ProductVersion:  18.5.3926.0
  531. ad0.14d8:     FileVersion:     18.5.3926.0
  532. ad0.14d8:     FileDescription: Stream Filter
  533. ad0.14d8: \SystemRoot\System32\drivers\aswVmm.sys:
  534. ad0.14d8:     CreationTime:    2018-05-18T13:33:44.050203400Z
  535. ad0.14d8:     LastWriteTime:   2018-06-24T17:30:43.871150500Z
  536. ad0.14d8:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  537. ad0.14d8:     FileAttributes:  0x20
  538. ad0.14d8:     Size:            0x5d290
  539. ad0.14d8:     NT Headers:      0xe8
  540. ad0.14d8:     Timestamp:       0x5b1f761e
  541. ad0.14d8:     Machine:         0x8664 - amd64
  542. ad0.14d8:     Timestamp:       0x5b1f761e
  543. ad0.14d8:     Image Version:   6.0
  544. ad0.14d8:     SizeOfImage:     0x5b000 (372736)
  545. ad0.14d8:     Resource Dir:    0x58000 LB 0x390
  546. ad0.14d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  547. ad0.14d8:     [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  548. ad0.14d8:     ProductName:     Avast Antivirus
  549. ad0.14d8:     ProductVersion:  18.5.3926.0
  550. ad0.14d8:     FileVersion:     18.5.3926.0
  551. ad0.14d8:     FileDescription: Avast VM Monitor
  552. ad0.14d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  553. ad0.14d8: Calling main()
  554. ad0.14d8: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  555. ad0.14d8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  556. ad0.14d8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  557. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  558. ad0.14d8: SUPR3HardenedMain: Respawn #2
  559. ad0.14d8: supR3HardNtEnableThreadCreation:
  560. ad0.14d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
  561. ad0.14d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
  562. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  563. ad0.14d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  564. ad0.14d8: supR3HardenedDllNotificationCallback: load   000007fefcb80000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
  565. ad0.14d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
  566. ad0.14d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcb80000 'C:\Windows\system32\apphelp.dll'
  567. ad0.14d8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  568. ad0.14d8: supR3HardenedWinDoReSpawn(2): New child 810.300 [kernel32].
  569. ad0.14d8: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd9000 cbPeb=0x380
  570. ad0.14d8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076da0000 uNtDllChildAddr=0000000076da0000
  571. ad0.14d8: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076dcc320
  572. ad0.14d8: supR3HardenedWinSetupChildInit: Start child.
  573. ad0.14d8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
  574. ad0.14d8: supR3HardNtChildPurify: Startup delay kludge #1/0: 528 ms, 57 sleeps
  575. ad0.14d8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
  576. ad0.14d8:  *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
  577. ad0.14d8:  *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
  578. ad0.14d8:  *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
  579. ad0.14d8:   0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
  580. ad0.14d8:  *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
  581. ad0.14d8:   0000000000041000-000000000016ffff 0x0001/0x0000 0x0000000
  582. ad0.14d8:  *0000000000170000-000000000026bfff 0x0000/0x0004 0x0020000
  583. ad0.14d8:   000000000026c000-000000000026dfff 0x0104/0x0004 0x0020000
  584. ad0.14d8:   000000000026e000-000000000026ffff 0x0004/0x0004 0x0020000
  585. ad0.14d8:   0000000000270000-0000000076d9ffff 0x0001/0x0000 0x0000000
  586. ad0.14d8:  *0000000076da0000-0000000076da0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  587. ad0.14d8:   0000000076da1000-0000000076ea2fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  588. ad0.14d8:   0000000076ea3000-0000000076ed1fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  589. ad0.14d8:   0000000076ed2000-0000000076eddfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  590. ad0.14d8:   0000000076ede000-0000000076f48fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
  591. ad0.14d8:   0000000076f49000-000000007efdffff 0x0001/0x0000 0x0000000
  592. ad0.14d8:  *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
  593. ad0.14d8:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
  594. ad0.14d8:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
  595. ad0.14d8:   000000007fff0000-000000013ff8ffff 0x0001/0x0000 0x0000000
  596. ad0.14d8:  *000000013ff90000-000000013ff90fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  597. ad0.14d8:   000000013ff91000-0000000140001fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  598. ad0.14d8:   0000000140002000-0000000140002fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  599. ad0.14d8:   0000000140003000-0000000140048fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  600. ad0.14d8:   0000000140049000-0000000140049fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  601. ad0.14d8:   000000014004a000-000000014004afff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  602. ad0.14d8:   000000014004b000-000000014004ffff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  603. ad0.14d8:   0000000140050000-0000000140050fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  604. ad0.14d8:   0000000140051000-0000000140051fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  605. ad0.14d8:   0000000140052000-0000000140055fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  606. ad0.14d8:   0000000140056000-000000014009dfff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe
  607. ad0.14d8:   000000014009e000-000007feff0bffff 0x0001/0x0000 0x0000000
  608. ad0.14d8:  *000007feff0c0000-000007feff0c0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
  609. ad0.14d8:   000007feff0c1000-000007fffffaffff 0x0001/0x0000 0x0000000
  610. ad0.14d8:  *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
  611. ad0.14d8:   000007fffffd3000-000007fffffd8fff 0x0001/0x0000 0x0000000
  612. ad0.14d8:  *000007fffffd9000-000007fffffd9fff 0x0004/0x0004 0x0020000
  613. ad0.14d8:   000007fffffda000-000007fffffddfff 0x0001/0x0000 0x0000000
  614. ad0.14d8:  *000007fffffde000-000007fffffdffff 0x0004/0x0004 0x0020000
  615. ad0.14d8:  *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
  616. ad0.14d8: apisetschema.dll: timestamp 0x4a5bdeab (rc=VINF_SUCCESS)
  617. ad0.14d8: VirtualBox.exe: timestamp 0x5b4cb14e (rc=VINF_SUCCESS)
  618. ad0.14d8: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  619. ad0.14d8: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
  620. ad0.14d8: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
  621. ad0.14d8: supR3HardNtChildPurify: Done after 543 ms and 0 fixes (loop #0).
  622. 810.300: Log file opened: 5.2.16r123759 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
  623. 810.300: supR3HardenedVmProcessInit: uNtDllAddr=0000000076da0000 g_uNtVerCombined=0x611db100
  624. ad0.14d8: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000280000 LB 0x400000)
  625. 810.300: ntdll.dll: timestamp 0x4ce7c8f9 (rc=VINF_SUCCESS)
  626. 810.300: New simple heap: #1 0000000000270000 LB 0x400000 (for 1740800 allocation)
  627. ad0.14d8: supR3HardNtEnableThreadCreation:
  628. 810.300: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  629. 810.300: System32:  \Device\HarddiskVolume2\Windows\System32
  630. 810.300: WinSxS:    \Device\HarddiskVolume2\Windows\winsxs
  631. 810.300: KnownDllPath: C:\Windows\system32
  632. 810.300: supR3HardenedVmProcessInit: Opening vboxdrv...
  633. 810.300: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
  634. 810.300: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
  635. 810.300: Registered Dll notification callback with NTDLL.
  636. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
  637. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
  638. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  639. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  640. 810.300: supR3HardenedDllNotificationCallback: load   0000000076b80000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
  641. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  642. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcfb0000 LB 0x0006b000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
  643. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
  644. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  645. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  646. 810.300: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076dcc320 pvNtTerminateThread=0000000076df1840
  647. ad0.14d8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 47 ms.
  648. 810.300: \SystemRoot\System32\ntdll.dll:
  649. 810.300:     CreationTime:    2010-11-21T03:23:51.351694200Z
  650. 810.300:     LastWriteTime:   2010-11-21T03:23:51.367294200Z
  651. 810.300:     ChangeTime:      2018-05-18T11:05:42.819872000Z
  652. 810.300:     FileAttributes:  0x20
  653. 810.300:     Size:            0x1a6d60
  654. 810.300:     NT Headers:      0xe0
  655. 810.300:     Timestamp:       0x4ce7c8f9
  656. 810.300:     Machine:         0x8664 - amd64
  657. 810.300:     Timestamp:       0x4ce7c8f9
  658. 810.300:     Image Version:   6.1
  659. 810.300:     SizeOfImage:     0x1a9000 (1740800)
  660. 810.300:     Resource Dir:    0x151000 LB 0x560d8
  661. 810.300:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
  662. 810.300:     [Raw version resource data: 0x1510f0 LB 0x380, codepage 0x0 (reserved 0x0)]
  663. 810.300:     ProductName:     Microsoft® Windows® Operating System
  664. 810.300:     ProductVersion:  6.1.7601.17514
  665. 810.300:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  666. 810.300:     FileDescription: NT Layer DLL
  667. 810.300: \SystemRoot\System32\kernel32.dll:
  668. 810.300:     CreationTime:    2010-11-21T03:24:07.965723400Z
  669. 810.300:     LastWriteTime:   2010-11-21T03:24:07.981323400Z
  670. 810.300:     ChangeTime:      2018-05-18T11:05:14.739822700Z
  671. 810.300:     FileAttributes:  0x20
  672. 810.300:     Size:            0x11b800
  673. 810.300:     NT Headers:      0xe8
  674. 810.300:     Timestamp:       0x4ce7c78b
  675. 810.300:     Machine:         0x8664 - amd64
  676. 810.300:     Timestamp:       0x4ce7c78b
  677. 810.300:     Image Version:   6.1
  678. 810.300:     SizeOfImage:     0x11f000 (1175552)
  679. 810.300:     Resource Dir:    0x116000 LB 0x528
  680. 810.300:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  681. 810.300:     [Raw version resource data: 0x1160b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
  682. 810.300:     ProductName:     Microsoft® Windows® Operating System
  683. 810.300:     ProductVersion:  6.1.7601.17514
  684. 810.300:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  685. 810.300:     FileDescription: Windows NT BASE API Client DLL
  686. 810.300: \SystemRoot\System32\KernelBase.dll:
  687. 810.300:     CreationTime:    2010-11-21T03:24:26.217755400Z
  688. 810.300:     LastWriteTime:   2010-11-21T03:24:26.248955500Z
  689. 810.300:     ChangeTime:      2018-05-18T11:05:14.755422700Z
  690. 810.300:     FileAttributes:  0x20
  691. 810.300:     Size:            0x66800
  692. 810.300:     NT Headers:      0xf0
  693. 810.300:     Timestamp:       0x4ce7c78c
  694. 810.300:     Machine:         0x8664 - amd64
  695. 810.300:     Timestamp:       0x4ce7c78c
  696. 810.300:     Image Version:   6.1
  697. 810.300:     SizeOfImage:     0x6b000 (438272)
  698. 810.300:     Resource Dir:    0x69000 LB 0x530
  699. 810.300:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
  700. 810.300:     [Raw version resource data: 0x690b0 LB 0x3ac, codepage 0x0 (reserved 0x0)]
  701. 810.300:     ProductName:     Microsoft® Windows® Operating System
  702. 810.300:     ProductVersion:  6.1.7601.17514
  703. 810.300:     FileVersion:     6.1.7601.17514 (win7sp1_rtm.101119-1850)
  704. 810.300:     FileDescription: Windows NT BASE API Client DLL
  705. 810.300: \SystemRoot\System32\apisetschema.dll:
  706. 810.300:     CreationTime:    2009-07-13T23:18:54.866423200Z
  707. 810.300:     LastWriteTime:   2009-07-14T01:24:53.779000000Z
  708. 810.300:     ChangeTime:      2018-05-18T11:04:54.522187200Z
  709. 810.300:     FileAttributes:  0x20
  710. 810.300:     Size:            0x1a00
  711. 810.300:     NT Headers:      0xc0
  712. 810.300:     Timestamp:       0x4a5bdeab
  713. 810.300:     Machine:         0x8664 - amd64
  714. 810.300:     Timestamp:       0x4a5bdeab
  715. 810.300:     Image Version:   6.1
  716. 810.300:     SizeOfImage:     0x50000 (327680)
  717. 810.300:     Resource Dir:    0x30000 LB 0x3f0
  718. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  719. 810.300:     [Raw version resource data: 0x30060 LB 0x390, codepage 0x0 (reserved 0x0)]
  720. 810.300:     ProductName:     Microsoft® Windows® Operating System
  721. 810.300:     ProductVersion:  6.1.7600.16385
  722. 810.300:     FileVersion:     6.1.7600.16385 (win7_rtm.090713-1255)
  723. 810.300:     FileDescription: ApiSet Schema DLL
  724. 810.300: NtOpenDirectoryObject failed on \Driver: 0xc0000022
  725. 810.300: supR3HardenedWinFindAdversaries: 0x4
  726. 810.300: \SystemRoot\System32\drivers\aswHwid.sys:
  727. 810.300:     CreationTime:    2018-05-18T13:33:42.817801200Z
  728. 810.300:     LastWriteTime:   2018-06-24T17:30:43.603950000Z
  729. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  730. 810.300:     FileAttributes:  0x20
  731. 810.300:     Size:            0xb780
  732. 810.300:     NT Headers:      0xf0
  733. 810.300:     Timestamp:       0x5b1f767e
  734. 810.300:     Machine:         0x8664 - amd64
  735. 810.300:     Timestamp:       0x5b1f767e
  736. 810.300:     Image Version:   6.0
  737. 810.300:     SizeOfImage:     0xa000 (40960)
  738. 810.300:     Resource Dir:    0x8000 LB 0x388
  739. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  740. 810.300:     [Raw version resource data: 0x8060 LB 0x324, codepage 0x0 (reserved 0x0)]
  741. 810.300:     ProductName:     Avast Antivirus
  742. 810.300:     ProductVersion:  18.5.3926.0
  743. 810.300:     FileVersion:     18.5.3926.0
  744. 810.300:     FileDescription: Avast HWID
  745. 810.300: \SystemRoot\System32\drivers\aswMonFlt.sys:
  746. 810.300:     CreationTime:    2018-05-18T13:33:43.067401700Z
  747. 810.300:     LastWriteTime:   2018-06-24T17:30:43.667350100Z
  748. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  749. 810.300:     FileAttributes:  0x20
  750. 810.300:     Size:            0x26f98
  751. 810.300:     NT Headers:      0xe8
  752. 810.300:     Timestamp:       0x5b1f75f5
  753. 810.300:     Machine:         0x8664 - amd64
  754. 810.300:     Timestamp:       0x5b1f75f5
  755. 810.300:     Image Version:   6.0
  756. 810.300:     SizeOfImage:     0x2b000 (176128)
  757. 810.300:     Resource Dir:    0x29000 LB 0x3b0
  758. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  759. 810.300:     [Raw version resource data: 0x29060 LB 0x34c, codepage 0x0 (reserved 0x0)]
  760. 810.300:     ProductName:     Avast Antivirus
  761. 810.300:     ProductVersion:  18.5.3926.0
  762. 810.300:     FileVersion:     18.5.3926.0
  763. 810.300:     FileDescription: Avast File System Minifilter for Windows 2003/Vista
  764. 810.300: \SystemRoot\System32\drivers\aswRdr2.sys:
  765. 810.300:     CreationTime:    2018-05-18T13:33:42.209400200Z
  766. 810.300:     LastWriteTime:   2018-06-24T17:30:43.039348800Z
  767. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  768. 810.300:     FileAttributes:  0x20
  769. 810.300:     Size:            0x1b500
  770. 810.300:     NT Headers:      0xe8
  771. 810.300:     Timestamp:       0x5b1f762c
  772. 810.300:     Machine:         0x8664 - amd64
  773. 810.300:     Timestamp:       0x5b1f762c
  774. 810.300:     Image Version:   6.1
  775. 810.300:     SizeOfImage:     0x1a000 (106496)
  776. 810.300:     Resource Dir:    0x18000 LB 0x398
  777. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  778. 810.300:     [Raw version resource data: 0x18060 LB 0x334, codepage 0x0 (reserved 0x0)]
  779. 810.300:     ProductName:     Avast Antivirus
  780. 810.300:     ProductVersion:  18.5.3926.0
  781. 810.300:     FileVersion:     18.5.3926.0 built by: WinDDK
  782. 810.300:     FileDescription: Avast WFP Redirect Driver
  783. 810.300: \SystemRoot\System32\drivers\aswRvrt.sys:
  784. 810.300:     CreationTime:    2018-05-18T13:33:43.317002100Z
  785. 810.300:     LastWriteTime:   2018-06-24T17:30:43.729750200Z
  786. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  787. 810.300:     FileAttributes:  0x20
  788. 810.300:     Size:            0x14fd0
  789. 810.300:     NT Headers:      0xf0
  790. 810.300:     Timestamp:       0x5b1f761a
  791. 810.300:     Machine:         0x8664 - amd64
  792. 810.300:     Timestamp:       0x5b1f761a
  793. 810.300:     Image Version:   6.0
  794. 810.300:     SizeOfImage:     0x14000 (81920)
  795. 810.300:     Resource Dir:    0x12000 LB 0x388
  796. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  797. 810.300:     [Raw version resource data: 0x12060 LB 0x328, codepage 0x0 (reserved 0x0)]
  798. 810.300:     ProductName:     Avast Antivirus
  799. 810.300:     ProductVersion:  18.5.3926.0
  800. 810.300:     FileVersion:     18.5.3926.0
  801. 810.300:     FileDescription: Avast Revert
  802. 810.300: \SystemRoot\System32\drivers\aswSnx.sys:
  803. 810.300:     CreationTime:    2018-05-18T13:33:41.554199000Z
  804. 810.300:     LastWriteTime:   2018-06-24T17:30:24.084108500Z
  805. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  806. 810.300:     FileAttributes:  0x20
  807. 810.300:     Size:            0xfae90
  808. 810.300:     NT Headers:      0xf0
  809. 810.300:     Timestamp:       0x5b1f764b
  810. 810.300:     Machine:         0x8664 - amd64
  811. 810.300:     Timestamp:       0x5b1f764b
  812. 810.300:     Image Version:   6.0
  813. 810.300:     SizeOfImage:     0xf8000 (1015808)
  814. 810.300:     Resource Dir:    0xf0000 LB 0x378
  815. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  816. 810.300:     [Raw version resource data: 0xf0060 LB 0x314, codepage 0x0 (reserved 0x0)]
  817. 810.300:     ProductName:     Avast Antivirus
  818. 810.300:     ProductVersion:  18.5.3926.0
  819. 810.300:     FileVersion:     18.5.3926.0
  820. 810.300:     FileDescription: Avast Virtualization Driver
  821. 810.300: \SystemRoot\System32\drivers\aswsp.sys:
  822. 810.300:     CreationTime:    2018-05-18T13:33:43.769402900Z
  823. 810.300:     LastWriteTime:   2018-07-23T15:04:03.246072700Z
  824. 810.300:     ChangeTime:      2018-07-23T15:04:03.246072700Z
  825. 810.300:     FileAttributes:  0x20
  826. 810.300:     Size:            0x72078
  827. 810.300:     NT Headers:      0xe0
  828. 810.300:     Timestamp:       0x5b4789fa
  829. 810.300:     Machine:         0x8664 - amd64
  830. 810.300:     Timestamp:       0x5b4789fa
  831. 810.300:     Image Version:   6.1
  832. 810.300:     SizeOfImage:     0x72000 (466944)
  833. 810.300:     Resource Dir:    0x70000 LB 0x378
  834. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  835. 810.300:     [Raw version resource data: 0x70060 LB 0x318, codepage 0x0 (reserved 0x0)]
  836. 810.300:     ProductName:     Avast Antivirus
  837. 810.300:     ProductVersion:  18.5.3931.340
  838. 810.300:     FileVersion:     18.5.3931.340
  839. 810.300:     FileDescription: Avast self protection module
  840. 810.300: \SystemRoot\System32\drivers\aswStm.sys:
  841. 810.300:     CreationTime:    2018-05-18T13:33:44.284203800Z
  842. 810.300:     LastWriteTime:   2018-06-24T17:30:44.232951300Z
  843. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  844. 810.300:     FileAttributes:  0x20
  845. 810.300:     Size:            0x338d8
  846. 810.300:     NT Headers:      0x110
  847. 810.300:     Timestamp:       0x5b1f768b
  848. 810.300:     Machine:         0x8664 - amd64
  849. 810.300:     Timestamp:       0x5b1f768b
  850. 810.300:     Image Version:   10.0
  851. 810.300:     SizeOfImage:     0x34000 (212992)
  852. 810.300:     Resource Dir:    0x32000 LB 0x350
  853. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x405)]
  854. 810.300:     [Raw version resource data: 0x32060 LB 0x2f0, codepage 0x0 (reserved 0x0)]
  855. 810.300:     ProductName:     Avast Antivirus
  856. 810.300:     ProductVersion:  18.5.3926.0
  857. 810.300:     FileVersion:     18.5.3926.0
  858. 810.300:     FileDescription: Stream Filter
  859. 810.300: \SystemRoot\System32\drivers\aswVmm.sys:
  860. 810.300:     CreationTime:    2018-05-18T13:33:44.050203400Z
  861. 810.300:     LastWriteTime:   2018-06-24T17:30:43.871150500Z
  862. 810.300:     ChangeTime:      2018-06-24T17:30:52.499569200Z
  863. 810.300:     FileAttributes:  0x20
  864. 810.300:     Size:            0x5d290
  865. 810.300:     NT Headers:      0xe8
  866. 810.300:     Timestamp:       0x5b1f761e
  867. 810.300:     Machine:         0x8664 - amd64
  868. 810.300:     Timestamp:       0x5b1f761e
  869. 810.300:     Image Version:   6.0
  870. 810.300:     SizeOfImage:     0x5b000 (372736)
  871. 810.300:     Resource Dir:    0x58000 LB 0x390
  872. 810.300:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
  873. 810.300:     [Raw version resource data: 0x58060 LB 0x330, codepage 0x0 (reserved 0x0)]
  874. 810.300:     ProductName:     Avast Antivirus
  875. 810.300:     ProductVersion:  18.5.3926.0
  876. 810.300:     FileVersion:     18.5.3926.0
  877. 810.300:     FileDescription: Avast VM Monitor
  878. 810.300: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  879. 810.300: Calling main()
  880. 810.300: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
  881. 810.300: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
  882. 810.300: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
  883. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
  884. 810.300: SUPR3HardenedMain: Final process, opening VBoxDrv...
  885. 810.300: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000270000 LB 0x400000)
  886. 810.300: supR3HardNtEnableThreadCreation:
  887. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
  888. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
  889. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  890. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  891. 810.300: supR3HardenedDllNotificationCallback: load   000007fef48a0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
  892. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  893. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  894. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  895. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  896. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
  897. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  898. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  899. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef48a0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
  900. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  901. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
  902. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  903. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  904. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
  905. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  906. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  907. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  908. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
  909. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  910. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  911. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  912. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
  913. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
  914. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  915. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  916. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  917. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
  918. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
  919. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  920. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  921. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  922. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
  923. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  924. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  925. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  926. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  927. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  928. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  929. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  930. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  931. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  932. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcf10000 LB 0x0003a000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
  933. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  934. 810.300: supR3HardenedDllNotificationCallback: load   000007fefdb50000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
  935. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  936. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcda0000 LB 0x00167000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
  937. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  938. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcd90000 LB 0x0000f000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
  939. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  940. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd770000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
  941. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  942. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\Wintrust.dll'
  943. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
  944. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  945. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  946. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  947. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc6d0000 LB 0x00022000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
  948. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  949. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6d0000 'C:\Windows\system32\bcrypt.dll'
  950. 810.300: bcrypt.dll loaded at 000007fefc6d0000, BCryptOpenAlgorithmProvider at 000007fefc6d2640, preloading providers:
  951. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
  952. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
  953. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
  954. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
  955. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  956. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  957. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  958. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  959. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  960. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  961. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
  962. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
  963. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  964. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  965. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  966. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  967. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  968. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  969. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  970. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  971. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  972. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc1c0000 LB 0x0004c000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
  973. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
  974. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd0d0000 LB 0x000db000 C:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
  975. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  976. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  977. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
  978. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
  979. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
  980. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd510000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
  981. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
  982. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc1c0000 'C:\Windows\system32\bcryptprimitives.dll'
  983. 810.300:     BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=000000000080aaf0)
  984. 810.300:     BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=000000000080d9b0)
  985. 810.300:     BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=000000000080dad0)
  986. 810.300:     BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=000000000080dce0)
  987. 810.300:     BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=000000000080de00)
  988. 810.300:     BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=000000000080df20)
  989. 810.300:     BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=000000000080e160)
  990. 810.300:     BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=000000000080e280)
  991. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
  992. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  993. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  994. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  995. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  996. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  997. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  998. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  999. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1000. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1001. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc580000 LB 0x00017000 C:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
  1002. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1003. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc580000 'C:\Windows\system32\CRYPTSP.dll'
  1004. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1005. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
  1006. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
  1007. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1008. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1009. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1010. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1011. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1012. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc280000 LB 0x00047000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
  1013. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
  1014. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc280000 'C:\Windows\system32\rsaenh.dll'
  1015. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1016. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1017. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  1018. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
  1019. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1020. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1021. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  1022. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcbe0000 LB 0x0000f000 C:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
  1023. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
  1024. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\CRYPTBASE.dll'
  1025. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
  1026. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1027. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'C:\Windows\system32\kernel32.dll'
  1028. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
  1029. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1030. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\WINTRUST.DLL'
  1031. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1032. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1033. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\CRYPT32.dll'
  1034. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1035. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
  1036. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1037. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1038. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1039. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1040. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imagehlp.dll (Input=imagehlp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1041. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1042. 810.300: supR3HardenedDllNotificationCallback: load   000007fefee30000 LB 0x00017000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
  1043. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
  1044. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefee30000 'C:\Windows\system32\imagehlp.dll'
  1045. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
  1046. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1047. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc580000 'C:\Windows\system32\CRYPTSP.dll'
  1048. 810.300: \Device\HarddiskVolume2\Windows\System32\user32.dll: Owner is administrators group.
  1049. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1050. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
  1051. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
  1052. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1053. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1054. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  1055. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
  1056. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
  1057. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1058. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
  1059. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume2\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
  1060. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1061. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1062. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
  1063. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\lpk.dll)
  1064. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\lpk.dll
  1065. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1066. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1067. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1068. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
  1069. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume2\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
  1070. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1071. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1072. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  1073. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\usp10.dll)
  1074. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\usp10.dll
  1075. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1076. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1077. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1078. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1079. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1080. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1081. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1082. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1083. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1084. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1085. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1086. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1087. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1088. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1089. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1090. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USER32.dll (Input=USER32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1091. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1092. 810.300: supR3HardenedDllNotificationCallback: load   0000000076ca0000 LB 0x000fa000 C:\Windows\system32\USER32.dll [fFlags=0x0]
  1093. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1094. 810.300: supR3HardenedDllNotificationCallback: load   000007fefe030000 LB 0x00067000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
  1095. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1096. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd530000 LB 0x0000e000 C:\Windows\system32\LPK.dll [fFlags=0x0]
  1097. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\lpk.dll [lacks WinVerifyTrust]
  1098. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd330000 LB 0x000c9000 C:\Windows\system32\USP10.dll [fFlags=0x0]
  1099. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\usp10.dll [lacks WinVerifyTrust]
  1100. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1101. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1102. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe030000 'C:\Windows\system32\gdi32.dll'
  1103. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
  1104. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  1105. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
  1106. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
  1107. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
  1108. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
  1109. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
  1110. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1111. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  1112. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  1113. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
  1114. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
  1115. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
  1116. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1117. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1118. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1119. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1120. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1121. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1122. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  1123. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  1124. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1125. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1126. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1127. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1128. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1129. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1130. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1131. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1132. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1133. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1134. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1135. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1136. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd6e0000 LB 0x0002e000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
  1137. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [lacks WinVerifyTrust]
  1138. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd400000 LB 0x00109000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
  1139. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [lacks WinVerifyTrust]
  1140. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6e0000 'C:\Windows\system32\IMM32.DLL'
  1141. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076ca0000 'C:\Windows\system32\USER32.dll'
  1142. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
  1143. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1144. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
  1145. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ncrypt.dll)
  1146. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1147. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
  1148. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
  1149. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
  1150. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1151. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1152. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1153. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
  1154. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
  1155. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1156. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ncrypt.dll (Input=ncrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1157. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1158. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc700000 LB 0x0004e000 C:\Windows\system32\ncrypt.dll [fFlags=0x0]
  1159. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
  1160. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc700000 'C:\Windows\system32\ncrypt.dll'
  1161. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
  1162. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (Input=bcrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1163. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc6d0000 'C:\Windows\system32\bcrypt.dll'
  1164. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1165. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
  1166. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
  1167. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\userenv.dll)
  1168. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
  1169. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
  1170. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
  1171. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1172. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
  1173. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
  1174. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1175. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1176. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1177. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1178. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1179. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1180. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1181. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1182. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1183. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USERENV.dll (Input=USERENV.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1184. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1185. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc040000 LB 0x0001e000 C:\Windows\system32\USERENV.dll [fFlags=0x0]
  1186. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [lacks WinVerifyTrust]
  1187. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1188. 810.300: supR3HardenedDllNotificationCallback: load   000007fefccf0000 LB 0x0000f000 C:\Windows\system32\profapi.dll [fFlags=0x0]
  1189. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1190. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc040000 'C:\Windows\system32\USERENV.dll'
  1191. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1192. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1193. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1194. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1195. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1196. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1197. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1198. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1199. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
  1200. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1201. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1202. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1203. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1204. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1205. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1206. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1207. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\GPAPI.dll (Input=GPAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1208. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1209. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc020000 LB 0x0001b000 C:\Windows\system32\GPAPI.dll [fFlags=0x0]
  1210. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
  1211. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc020000 'C:\Windows\system32\GPAPI.dll'
  1212. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1213. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1214. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1215. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1216. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1217. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd770000 'C:\Windows\system32\rpcrt4.dll'
  1218. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1219. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1220. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L2-1-0.dll'
  1221. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1222. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1223. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1224. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1225. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'crypt32.dll'.
  1226. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'wldap32.dll'.
  1227. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
  1228. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1229. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
  1230. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
  1231. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1232. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\Wldap32.dll)
  1233. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1234. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
  1235. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
  1236. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
  1237. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1238. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1239. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1240. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1241. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1242. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1243. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1244. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1245. 810.300: supR3HardenedDllNotificationCallback: load   000007fef4790000 LB 0x00026000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
  1246. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1247. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd710000 LB 0x00052000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
  1248. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
  1249. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1250. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1251. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1252. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1253. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1254. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1255. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1256. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1257. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1258. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1259. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1260. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1261. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1262. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1263. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1264. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1265. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x1002 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1266. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1267. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1268. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1269. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1270. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1271. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1272. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1273. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1274. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1275. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1276. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1277. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1278. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1279. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  1280. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
  1281. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
  1282. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1283. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1284. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1285. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1286. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1287. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1288. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1289. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1290. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1291. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1292. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHLWAPI.dll (Input=SHLWAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1293. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1294. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd660000 LB 0x00071000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
  1295. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
  1296. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd660000 'C:\Windows\system32\SHLWAPI.dll'
  1297. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1298. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1299. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1300. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
  1301. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1302. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccf0000 'C:\Windows\system32\profapi.dll'
  1303. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'cfgmgr32.dll'.
  1304. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcrt.dll'.
  1305. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
  1306. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1307. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1308. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
  1309. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'devobj.dll'.
  1310. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll)
  1311. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1312. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
  1313. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
  1314. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1315. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'cfgmgr32.dll'.
  1316. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devobj.dll)
  1317. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
  1318. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1319. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1320. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1321. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1322. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
  1323. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
  1324. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
  1325. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll)
  1326. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1327. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1328. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1329. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1330. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1331. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1332. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1333. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1334. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1335. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1336. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1337. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1338. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1339. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1340. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1341. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1342. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
  1343. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1344. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll)
  1345. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1346. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1347. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1348. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1349. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1350. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1351. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1352. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1353. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1354. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1355. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1356. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1357. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1358. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1359. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1360. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1361. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1362. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1363. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1364. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1365. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1366. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1367. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1368. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1369. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1370. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
  1371. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
  1372. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
  1373. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ole32.dll)
  1374. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1375. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
  1376. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
  1377. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  1378. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1379. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1380. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1381. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1382. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1383. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
  1384. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1385. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1386. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
  1387. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  1388. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  1389. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
  1390. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1391. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1392. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1393. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\setupapi.dll (Input=setupapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1394. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  1395. 810.300: supR3HardenedDllNotificationCallback: load   000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [fFlags=0x0]
  1396. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll [lacks WinVerifyTrust]
  1397. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  1398. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
  1399. 810.300: supR3HardenedDllNotificationCallback: load   000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  1400. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll [lacks WinVerifyTrust]
  1401. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  1402. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ole32.dll [lacks WinVerifyTrust]
  1403. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  1404. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [lacks WinVerifyTrust]
  1405. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1406. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1407. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  1408. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefdbf0000 'C:\Windows\system32\setupapi.dll'
  1409. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1410. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cabinet.dll)
  1411. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1412. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1413. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1414. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1415. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Cabinet.dll (Input=Cabinet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1416. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1417. 810.300: supR3HardenedDllNotificationCallback: load   000007fef4770000 LB 0x0001b000 C:\Windows\system32\Cabinet.dll [fFlags=0x0]
  1418. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cabinet.dll [lacks WinVerifyTrust]
  1419. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4770000 'C:\Windows\system32\Cabinet.dll'
  1420. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1421. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\devrtl.dll)
  1422. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1423. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1424. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1425. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
  1426. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\DEVRTL.dll (Input=DEVRTL.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1427. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1428. 810.300: supR3HardenedDllNotificationCallback: load   000007fefc060000 LB 0x00012000 C:\Windows\system32\DEVRTL.dll [fFlags=0x0]
  1429. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll [lacks WinVerifyTrust]
  1430. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc060000 'C:\Windows\system32\DEVRTL.dll'
  1431. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\setupapi.dll [flags=0x0]
  1432. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [flags=0x0]
  1433. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [flags=0x0]
  1434. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [flags=0x0]
  1435. 810.300: supR3HardenedDllNotificationCallback: Unload 000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [flags=0x0]
  1436. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
  1437. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef4790000 'C:\Windows\system32\cryptnet.dll'
  1438. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
  1439. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008056a0
  1440. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1441. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6463B603CF12442718467D754A1EDC45CE1D6E7E
  1442. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1443. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1444. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
  1445. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1446. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1447. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-Management-L1-1-0.dll'
  1448. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1449. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1450. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
  1451. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
  1452. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1453. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  1454. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1455. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1456. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1457. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  1458. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1459. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd510000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
  1460. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\SystemRoot\System32\ntdll.dll'
  1461. 810.300: g_pfnWinVerifyTrust=000007fefcf11010
  1462. 810.300: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
  1463. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e0 pwszName=\Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1464. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1465. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1466. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=766DAE0DAEDFFD0DB96611658C619DD5922D2FEC
  1467. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1468. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1469. 810.300: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
  1470. 810.300: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
  1471. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d4 pwszName=\Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1472. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1473. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1474. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E8D9B442D9CC38B2D0501106E104A42A4EE0B238
  1475. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1476. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1477. 810.300: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
  1478. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003ec pwszName=\Device\HarddiskVolume2\Windows\System32\devrtl.dll
  1479. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1480. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1481. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=445E5B0E9F43B5D56A5B9C4BC3369E3D076ACA1A
  1482. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1483. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1484. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
  1485. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e0 pwszName=\Device\HarddiskVolume2\Windows\System32\cabinet.dll
  1486. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1487. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1488. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5D1555851298EA005A2E9FEA027F5898BC240083
  1489. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1490. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1491. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cabinet.dll'
  1492. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a8 pwszName=\Device\HarddiskVolume2\Windows\System32\ole32.dll
  1493. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1494. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1495. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E64AE329BD5124592BC8CB0B327AA3B95DC65B7
  1496. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1497. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1498. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ole32.dll'
  1499. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a4 pwszName=\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  1500. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1501. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1502. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8F731777EFC4BC982C1E1467FBF29A74CC14D93A
  1503. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1504. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1505. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
  1506. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003a0 pwszName=\Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1507. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1508. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1509. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=26A5C3FE898CBD66951D3BC65E742E0BE561E69B
  1510. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1511. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1512. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll'
  1513. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000039c pwszName=\Device\HarddiskVolume2\Windows\System32\devobj.dll
  1514. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1515. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1516. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B410A095222E69F0ECE7D66E4AC27A7125D2EB5A
  1517. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1518. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1519. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devobj.dll'
  1520. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000398 pwszName=\Device\HarddiskVolume2\Windows\System32\setupapi.dll
  1521. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1522. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1523. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1499C4FEA6E143F9BEC35B4FFA098917D3A6EBF2
  1524. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1525. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1526. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\setupapi.dll'
  1527. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000038c pwszName=\Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  1528. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1529. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1530. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0AB8D9C9D3E1FC95D01F9A984B16ED031BB40CD8
  1531. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1532. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1533. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
  1534. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000380 pwszName=\Device\HarddiskVolume2\Windows\System32\Wldap32.dll
  1535. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1536. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1537. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=87E73086F2528CF31D3AD5F0D71E04F8B942D5D8
  1538. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1539. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1540. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
  1541. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000037c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptnet.dll
  1542. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1543. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1544. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CA2FE16E05087DA5C24DC5EB2EE8053CDA5DE9A9
  1545. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1546. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1547. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
  1548. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000258 pwszName=\Device\HarddiskVolume2\Windows\System32\gpapi.dll
  1549. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1550. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1551. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=470795C189226F7BDB8E50F42104CC34488B9340
  1552. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1553. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1554. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
  1555. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c4 pwszName=\Device\HarddiskVolume2\Windows\System32\profapi.dll
  1556. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1557. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1558. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
  1559. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1560. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1561. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
  1562. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001c0 pwszName=\Device\HarddiskVolume2\Windows\System32\userenv.dll
  1563. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1564. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1565. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3E1A2CC7367F751C19EBF4E6EDF5E9A10E47313
  1566. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1567. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1568. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll'
  1569. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001ac pwszName=\Device\HarddiskVolume2\Windows\System32\ncrypt.dll
  1570. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1571. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1572. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3D482C50075646C922DC6A66C97956C5060C361B
  1573. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1574. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1575. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
  1576. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000194 pwszName=\Device\HarddiskVolume2\Windows\System32\msctf.dll
  1577. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1578. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1579. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=803AF52F95A9EFDFDA06C595023831EE36ACD3A8
  1580. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1581. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1582. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
  1583. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000190 pwszName=\Device\HarddiskVolume2\Windows\System32\imm32.dll
  1584. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1585. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1586. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6EEE1AB3B6D79AFF857940FF5F51ED27698153EC
  1587. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1588. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1589. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
  1590. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000018c pwszName=\Device\HarddiskVolume2\Windows\System32\usp10.dll
  1591. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1592. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1593. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=97AE9B5B40144F2794F30A891013393C80D631A1
  1594. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1595. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1596. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\usp10.dll'
  1597. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000188 pwszName=\Device\HarddiskVolume2\Windows\System32\lpk.dll
  1598. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1599. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1600. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A42DFBB8A3A26D2178D79D34DA1CE275E2A0BE37
  1601. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1602. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1603. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\lpk.dll'
  1604. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000184 pwszName=\Device\HarddiskVolume2\Windows\System32\gdi32.dll
  1605. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1606. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1607. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C8F7179D2AEB0FEB168A01D182223AC2D7B8F331
  1608. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1609. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1610. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
  1611. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000180 pwszName=\Device\HarddiskVolume2\Windows\System32\user32.dll
  1612. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1613. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1614. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1615. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
  1616. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000008056a0
  1617. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1618. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FB05A6DD4AF9AC247D37C4B7BAFCCBD178A41E64
  1619. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERRROR_NOT_FOUND (1168)
  1620. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
  1621. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: -22900 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
  1622. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume2\Windows\System32\imagehlp.dll
  1623. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1624. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1625. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AFE89CF1060867A10BD3963894BCDB4D3058F804
  1626. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1627. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1628. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
  1629. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000130 pwszName=\Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  1630. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1631. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1632. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A965CC5DB13A5FB23BBB1B6B5FA6D400DC49462F
  1633. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1634. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1635. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
  1636. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
  1637. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000012c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptsp.dll
  1638. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1639. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1640. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=40667EDBA9045D4A4BE1D4844665D3B88F8CD0E0
  1641. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1642. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1643. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
  1644. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000120 pwszName=\Device\HarddiskVolume2\Windows\System32\sechost.dll
  1645. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1646. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1647. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3FA2A014BF360CDC0E203A174FFC9DC5343C5323
  1648. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1649. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1650. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
  1651. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000011c pwszName=\Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1652. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1653. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1654. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DBCDF817D89920EE3139FB7E090744EB36A4A21B
  1655. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1656. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1657. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
  1658. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
  1659. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume2\Windows\System32\bcrypt.dll
  1660. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1661. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1662. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62E377A1F0AD0C2EDC0A73CB3EFF841FF18D00D2
  1663. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1664. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1665. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
  1666. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e4 pwszName=\Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  1667. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1668. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1669. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DBEAC8C0FA88C88B540ACFE0683B1810C077AA53
  1670. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1671. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1672. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
  1673. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000dc pwszName=\Device\HarddiskVolume2\Windows\System32\msasn1.dll
  1674. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1675. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1676. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F2FF57DC30D774F93061607060DAA0DD15E39CCE
  1677. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1678. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1679. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
  1680. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000d8 pwszName=\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
  1681. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1682. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1683. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BC4D9E909DFDD2EE8BA1A5C857D73D49EBE7952C
  1684. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1685. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1686. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
  1687. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
  1688. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume2\Windows\System32\KernelBase.dll
  1689. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1690. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1691. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=06FEC3C858DB28D2F4BFBDA99AF14D4747A8C5D4
  1692. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1693. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1694. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
  1695. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume2\Windows\System32\kernel32.dll
  1696. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1697. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1698. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D7AE634A00F24BBD4AE27DEA9BCCCE222DE9897B
  1699. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1700. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1701. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
  1702. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1703. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1704. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\crypt32.dll'
  1705. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
  1706. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
  1707. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
  1708. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
  1709. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa7446a7757ff9500 OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root
  1710. 810.300: supR3HardenedWinIsDesiredRootCA: skipping - not-self-signed: C=BZ, ST=Belize, L=Belize city, O=Disc Soft Ltd, CN=Disc Soft Ltd, Email=finpr@disc-soft.com
  1711. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
  1712. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
  1713. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
  1714. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
  1715. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
  1716. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
  1717. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
  1718. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
  1719. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
  1720. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
  1721. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
  1722. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
  1723. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
  1724. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
  1725. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x802b3770cb00af00 C=EU, L=Madrid (see current address at www.camerfirma.com/address), SRN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008
  1726. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
  1727. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
  1728. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
  1729. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
  1730. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
  1731. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
  1732. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
  1733. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
  1734. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
  1735. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
  1736. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
  1737. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
  1738. 810.300: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
  1739. 810.300: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=33
  1740. 810.300: SUPR3HardenedMain: Load Runtime...
  1741. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1742. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
  1743. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
  1744. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
  1745. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
  1746. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1747. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1748. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1749. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  1750. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  1751. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003dc pwszName=\Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1752. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1753. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1754. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3EF3BDC1E84DFA17EA056313214EE88EC3E66F79
  1755. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\ws2_32.dll'
  1756. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1757. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1758. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
  1759. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
  1760. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll) WinVerifyTrust
  1761. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1762. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1763. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1764. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
  1765. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
  1766. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1767. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1768. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1769. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
  1770. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1771. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1772. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1773. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1774. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
  1775. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
  1776. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b4 pwszName=\Device\HarddiskVolume2\Windows\System32\nsi.dll
  1777. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1778. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1779. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7AFD8538945F2D05BC1AF949B9B19B7D2D9FBBF8
  1780. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\nsi.dll'
  1781. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1782. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll) WinVerifyTrust
  1783. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1784. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
  1785. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
  1786. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  1787. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  1788. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1789. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1790. 810.300: supR3HardenedDllNotificationCallback: load   000007fee44f0000 LB 0x00595000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
  1791. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1792. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1793. 810.300: supR3HardenedDllNotificationCallback: load   000000006f300000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
  1794. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1795. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1796. 810.300: supR3HardenedDllNotificationCallback: load   000000006f260000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
  1797. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1798. 810.300: supR3HardenedDllNotificationCallback: load   000007feff060000 LB 0x0004d000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
  1799. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  1800. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd0c0000 LB 0x00008000 C:\Windows\system32\NSI.dll [fFlags=0x0]
  1801. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll
  1802. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1803. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1804. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1805. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1806. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1807. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1808. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1809. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1810. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1811. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1812. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1813. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1814. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1815. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1816. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1817. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1818. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1819. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1820. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1821. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1822. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1823. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1824. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1825. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1826. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1827. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1828. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1829. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1830. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1831. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1832. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1833. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1834. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1835. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1836. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1837. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1838. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1839. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1840. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1841. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1842. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1843. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1844. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1845. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxRT.dll
  1846. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000007c4410:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1847. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1848. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1849. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1850. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee44f0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
  1851. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
  1852. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1853. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcf10000 'C:\Windows\system32\Wintrust.dll'
  1854. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
  1855. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  1856. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcda0000 'C:\Windows\system32\crypt32.dll'
  1857. 810.300: SUPR3HardenedMain: Load TrustedMain...
  1858. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
  1859. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
  1860. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
  1861. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1862. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1863. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
  1864. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
  1865. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
  1866. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
  1867. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
  1868. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
  1869. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
  1870. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
  1871. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
  1872. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
  1873. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll) WinVerifyTrust
  1874. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  1875. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  1876. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  1877. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000043c pwszName=\Device\HarddiskVolume2\Windows\System32\winmm.dll
  1878. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1879. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1880. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=82E2B2A7826F88BEB98FFF0540C9BDB0A12F001A
  1881. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\winmm.dll'
  1882. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1883. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
  1884. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1885. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll) WinVerifyTrust
  1886. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
  1887. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  1888. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  1889. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  1890. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  1891. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  1892. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  1893. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  1894. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  1895. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000424 pwszName=\Device\HarddiskVolume2\Windows\System32\shell32.dll
  1896. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1897. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1898. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FCF00DB9BBECF4126AB4076577BBA73C0F94BDF9
  1899. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\shell32.dll'
  1900. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1901. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1902. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'shlwapi.dll'.
  1903. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
  1904. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
  1905. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll) WinVerifyTrust
  1906. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
  1907. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  1908. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  1909. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  1910. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1911. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1912. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
  1913. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
  1914. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
  1915. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
  1916. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
  1917. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
  1918. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
  1919. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  1920. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
  1921. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
  1922. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1923. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1924. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
  1925. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
  1926. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1927. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
  1928. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
  1929. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
  1930. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll) WinVerifyTrust
  1931. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  1932. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  1933. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  1934. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  1935. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1936. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
  1937. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
  1938. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
  1939. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1940. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1941. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
  1942. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  1943. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  1944. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  1945. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
  1946. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  1947. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  1948. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  1949. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
  1950. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
  1951. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
  1952. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll) WinVerifyTrust
  1953. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  1954. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  1955. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  1956. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
  1957. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
  1958. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
  1959. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
  1960. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
  1961. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
  1962. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
  1963. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
  1964. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll) WinVerifyTrust
  1965. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  1966. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  1967. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  1968. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  1969. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  1970. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  1971. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  1972. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
  1973. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
  1974. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  1975. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  1976. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000044c pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1977. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1978. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1979. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=608AC397FCC42B9FBAE25CB8C25EAF4C19AA384D
  1980. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
  1981. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  1982. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  1983. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
  1984. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  1985. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
  1986. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
  1987. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
  1988. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll) WinVerifyTrust
  1989. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  1990. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  1991. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  1992. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
  1993. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
  1994. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000464 pwszName=\Device\HarddiskVolume2\Windows\System32\ddraw.dll
  1995. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  1996. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  1997. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
  1998. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ddraw.dll'
  1999. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2000. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2001. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2002. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
  2003. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  2004. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
  2005. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
  2006. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ddraw.dll) WinVerifyTrust
  2007. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2008. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
  2009. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
  2010. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000470 pwszName=\Device\HarddiskVolume2\Windows\System32\glu32.dll
  2011. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2012. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2013. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60E45AB914E06A11F44EA76C6EF750AF892F9EA2
  2014. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume2\Windows\System32\glu32.dll'
  2015. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2016. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2017. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
  2018. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2019. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\glu32.dll) WinVerifyTrust
  2020. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2021. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2022. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2023. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2024. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2025. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2026. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2027. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2028. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2029. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2030. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2031. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2032. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2033. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2034. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
  2035. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
  2036. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000450 pwszName=\Device\HarddiskVolume2\Windows\System32\mpr.dll
  2037. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2038. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2039. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84FE9BA047B24E7694C9E0C349B48B9FD5F925B
  2040. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\mpr.dll'
  2041. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2042. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mpr.dll) WinVerifyTrust
  2043. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2044. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
  2045. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
  2046. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
  2047. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2048. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2049. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2050. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2051. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2052. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2053. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2054. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2055. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2056. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2057. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2058. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2059. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2060. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2061. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2062. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2063. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2064. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2065. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2066. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2067. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2068. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2069. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2070. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2071. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2072. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2073. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2074. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2075. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2076. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2077. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2078. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2079. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2080. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
  2081. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
  2082. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcp100.dll
  2083. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2084. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2085. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2086. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2087. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2088. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2089. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2090. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2091. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2092. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2093. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2094. 810.300: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
  2095. 810.300: Error (rc=0):
  2096. 810.300: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=16 \Device\HarddiskVolume2\Windows\System32\user32.dll
  2097. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2098. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2099. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2100. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2101. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll
  2102. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
  2103. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
  2104. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000480 pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2105. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2106. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2107. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=66EE5BDFFA413AEA9E1FE7838A08646E94136DA5
  2108. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
  2109. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2110. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2111. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
  2112. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2113. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
  2114. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
  2115. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2116. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll) WinVerifyTrust
  2117. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2118. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
  2119. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
  2120. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000046c pwszName=\Device\HarddiskVolume2\Windows\System32\winspool.drv
  2121. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2122. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2123. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C89A2ED7B99A056D78CA6BAC9CCAB8B1FF119A14
  2124. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\winspool.drv'
  2125. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2126. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2127. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
  2128. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2129. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winspool.drv) WinVerifyTrust
  2130. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2131. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2132. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2133. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2134. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2135. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2136. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2137. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2138. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2139. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2140. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2141. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2142. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2143. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2144. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2145. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2146. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2147. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2148. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2149. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2150. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2151. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2152. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
  2153. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
  2154. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2155. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2156. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2157. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2158. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2159. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2160. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2161. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2162. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2163. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2164. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2165. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2166. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2167. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2168. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2169. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2170. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2171. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2172. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
  2173. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2174. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2175. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2176. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2177. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2178. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
  2179. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
  2180. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000488 pwszName=\Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2181. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2182. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2183. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4D3B2DA266DE92D9E1311E30C810160CDC5BD5AA
  2184. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
  2185. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2186. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2187. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2188. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2189. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll) WinVerifyTrust
  2190. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
  2191. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2192. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2193. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2194. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2195. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
  2196. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
  2197. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
  2198. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2199. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2200. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2201. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2202. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
  2203. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
  2204. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2205. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2206. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2207. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
  2208. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
  2209. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000494 pwszName=\Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2210. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2211. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2212. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B79EE7B5AD74EF51A849809202E043183A2C727E
  2213. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
  2214. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2215. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2216. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2217. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
  2218. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll) WinVerifyTrust
  2219. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2220. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
  2221. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
  2222. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2223. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2224. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2225. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
  2226. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
  2227. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000498 pwszName=\Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2228. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2229. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2230. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D3FEC714D729F7CAEB9B7A25E2012B6A6E9007F5
  2231. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat'; file='\Device\HarddiskVolume2\Windows\System32\dciman32.dll'
  2232. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2233. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2234. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
  2235. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2236. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dciman32.dll) WinVerifyTrust
  2237. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2238. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2239. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2240. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2241. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2242. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2243. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2244. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2245. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2246. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2247. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2248. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2249. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2250. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2251. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2252. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2253. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2254. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
  2255. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2256. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2257. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2258. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2259. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2260. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2261. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
  2262. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2263. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2264. 810.300: supR3HardenedDllNotificationCallback: load   000007fee3890000 LB 0x00a06000 C:\Program Files\Oracle\VirtualBox\VirtualBox.dll [fFlags=0x0]
  2265. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll
  2266. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2267. 810.300: supR3HardenedDllNotificationCallback: load   000007fee43d0000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [fFlags=0x0]
  2268. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
  2269. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2270. 810.300: supR3HardenedDllNotificationCallback: load   000007fee4c50000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [fFlags=0x0]
  2271. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\glu32.dll
  2272. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2273. 810.300: supR3HardenedDllNotificationCallback: load   000007fee3790000 LB 0x000f1000 C:\Windows\system32\DDRAW.dll [fFlags=0x0]
  2274. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll
  2275. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2276. 810.300: supR3HardenedDllNotificationCallback: load   000007fef0400000 LB 0x00008000 C:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
  2277. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll
  2278. 810.300: supR3HardenedDllNotificationCallback: load   000007fefdbf0000 LB 0x001d7000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
  2279. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
  2280. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcf50000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
  2281. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
  2282. 810.300: supR3HardenedDllNotificationCallback: load   000007fefef80000 LB 0x000d7000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
  2283. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2284. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd940000 LB 0x00203000 C:\Windows\system32\ole32.dll [fFlags=0x0]
  2285. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2286. 810.300: supR3HardenedDllNotificationCallback: load   000007fefcf90000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
  2287. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
  2288. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2289. 810.300: supR3HardenedDllNotificationCallback: load   000007fefadf0000 LB 0x00018000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
  2290. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
  2291. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2292. 810.300: supR3HardenedDllNotificationCallback: load   0000000063d70000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
  2293. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2294. 810.300: supR3HardenedDllNotificationCallback: load   000007fefe0a0000 LB 0x00d88000 C:\Windows\system32\SHELL32.dll [fFlags=0x0]
  2295. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2296. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2297. 810.300: supR3HardenedDllNotificationCallback: load   000007fef8af0000 LB 0x00018000 C:\Windows\system32\MPR.dll [fFlags=0x0]
  2298. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
  2299. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2300. 810.300: supR3HardenedDllNotificationCallback: load   000007fee3190000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
  2301. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2302. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2303. 810.300: supR3HardenedDllNotificationCallback: load   0000000063800000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
  2304. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
  2305. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  2306. 810.300: supR3HardenedDllNotificationCallback: load   000007fee3130000 LB 0x00051000 C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll [fFlags=0x0]
  2307. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll
  2308. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2309. 810.300: supR3HardenedDllNotificationCallback: load   000007fef9130000 LB 0x00071000 C:\Windows\system32\WINSPOOL.DRV [fFlags=0x0]
  2310. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winspool.drv
  2311. 810.300: supR3HardenedDllNotificationCallback: load   000007fefd540000 LB 0x00097000 C:\Windows\system32\COMDLG32.dll [fFlags=0x0]
  2312. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
  2313. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
  2314. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
  2315. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
  2316. 810.300: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll)
  2317. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll
  2318. 810.300: supR3HardenedDllNotificationCallback: load   000007fef91b0000 LB 0x000a0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32.dll [fFlags=0x0]
  2319. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll [avoiding WinVerifyTrust]
  2320. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2321. 810.300: supR3HardenedDllNotificationCallback: load   0000000064a10000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
  2322. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
  2323. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2324. 810.300: supR3HardenedDllNotificationCallback: load   000007fef99b0000 LB 0x0003b000 C:\Windows\system32\WINMM.dll [fFlags=0x0]
  2325. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2326. 810.300: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll'.
  2327. 810.300: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll' [rescheduled]
  2328. 810.300: supR3HardenedIsApiSetDll: '<NULL>' -> true
  2329. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2330. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b80000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
  2331. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2332. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2333. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2334. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2335. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2336. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2337. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2338. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2339. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd6e0000 'C:\Windows\system32\imm32.dll'
  2340. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.DLL'
  2341. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2342. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptbase.dll (Input=cryptbase.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
  2343. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\cryptbase.dll'
  2344. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee3890000 'C:\Program Files\Oracle\VirtualBox\VirtualBox.dll'
  2345. 810.300: SUPR3HardenedMain: Calling TrustedMain (000007fee38914f0)...
  2346. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2347. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2348. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd940000 'C:\Windows\system32\ole32.dll'
  2349. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd0d0000 'C:\Windows\system32\ADVAPI32.dll'
  2350. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\profapi.dll
  2351. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2352. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccf0000 'C:\Windows\system32\profapi.dll'
  2353. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
  2354. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
  2355. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
  2356. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
  2357. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
  2358. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
  2359. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
  2360. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
  2361. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
  2362. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
  2363. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
  2364. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
  2365. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2366. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
  2367. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
  2368. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
  2369. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
  2370. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
  2371. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
  2372. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
  2373. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
  2374. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
  2375. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
  2376. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
  2377. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
  2378. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
  2379. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
  2380. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
  2381. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
  2382. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
  2383. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
  2384. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
  2385. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
  2386. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
  2387. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
  2388. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2389. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2390. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
  2391. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
  2392. 810.300: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
  2393. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2394. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2395. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2396. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2397. 810.300: supR3HardenedDllNotificationCallback: load   000007fee3000000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
  2398. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
  2399. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fee3000000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
  2400. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
  2401. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000002a4c1c0:C:\Program Files\Oracle\VirtualBox;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2402. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbe0000 'C:\Windows\system32\CRYPTBASE.dll'
  2403. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000528 pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2404. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000008056a0
  2405. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000008056a0
  2406. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=936D45CC7026757A151F62882B557DD75D5FCB21
  2407. 810.300: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
  2408. 810.300: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
  2409. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
  2410. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
  2411. 810.300: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
  2412. 810.300: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll) WinVerifyTrust
  2413. 810.300: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2414. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
  2415. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
  2416. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
  2417. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
  2418. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
  2419. 810.300: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
  2420. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2421. 810.300: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2422. 810.300: supR3HardenedDllNotificationCallback: load   000007fefb1d0000 LB 0x00056000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
  2423. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2424. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2425. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2426. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2427. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2428. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2429. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2430. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2431. 810.300: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
  2432. 810.300: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000003320710:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Python27;C:\Python27\Scripts;C:\Python34;C:\Python34\Scripts [calling]
  2433. 810.300: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefb1d0000 'C:\Windows\system32\uxtheme.dll'
  2434. ad0.14d8: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1170 ms, the end);
  2435. 318.d10: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1775 ms, the end);
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top