VirtualBox

Ticket #19761: VBoxHardening.log

File VBoxHardening.log, 505.8 KB (added by MercyLin, 4 years ago)

more log

Line 
128a0.1c28: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000074 g_uNtVerCombined=0xa047bb00
228a0.1c28: \SystemRoot\System32\ntdll.dll:
328a0.1c28: CreationTime: 2020-07-22T06:39:52.722087600Z
428a0.1c28: LastWriteTime: 2020-07-22T06:39:52.737736600Z
528a0.1c28: ChangeTime: 2020-07-22T06:57:41.475577900Z
628a0.1c28: FileAttributes: 0x20
728a0.1c28: Size: 0x1e8460
828a0.1c28: NT Headers: 0xd8
928a0.1c28: Timestamp: 0xb29ecf52
1028a0.1c28: Machine: 0x8664 - amd64
1128a0.1c28: Timestamp: 0xb29ecf52
1228a0.1c28: Image Version: 10.0
1328a0.1c28: SizeOfImage: 0x1f0000 (2031616)
1428a0.1c28: Resource Dir: 0x17f000 LB 0x6f310
1528a0.1c28: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
1628a0.1c28: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
1728a0.1c28: ProductName: Microsoft® Windows® Operating System
1828a0.1c28: ProductVersion: 10.0.18362.815
1928a0.1c28: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
2028a0.1c28: FileDescription: NT Layer DLL
2128a0.1c28: \SystemRoot\System32\kernel32.dll:
2228a0.1c28: CreationTime: 2020-07-22T06:39:35.572371500Z
2328a0.1c28: LastWriteTime: 2020-07-22T06:39:35.572371500Z
2428a0.1c28: ChangeTime: 2020-07-22T06:57:41.022465900Z
2528a0.1c28: FileAttributes: 0x20
2628a0.1c28: Size: 0xb0498
2728a0.1c28: NT Headers: 0xe8
2828a0.1c28: Timestamp: 0xce6bbd73
2928a0.1c28: Machine: 0x8664 - amd64
3028a0.1c28: Timestamp: 0xce6bbd73
3128a0.1c28: Image Version: 10.0
3228a0.1c28: SizeOfImage: 0xb2000 (729088)
3328a0.1c28: Resource Dir: 0xb0000 LB 0x520
3428a0.1c28: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
3528a0.1c28: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
3628a0.1c28: ProductName: Microsoft® Windows® Operating System
3728a0.1c28: ProductVersion: 10.0.18362.959
3828a0.1c28: FileVersion: 10.0.18362.959 (WinBuild.160101.0800)
3928a0.1c28: FileDescription: Windows NT BASE API Client DLL
4028a0.1c28: \SystemRoot\System32\KernelBase.dll:
4128a0.1c28: CreationTime: 2020-07-22T06:57:20.479306600Z
4228a0.1c28: LastWriteTime: 2020-07-22T06:57:20.526169200Z
4328a0.1c28: ChangeTime: 2020-07-22T06:59:21.051113100Z
4428a0.1c28: FileAttributes: 0x20
4528a0.1c28: Size: 0x2a3868
4628a0.1c28: NT Headers: 0xf8
4728a0.1c28: Timestamp: 0x91b9349a
4828a0.1c28: Machine: 0x8664 - amd64
4928a0.1c28: Timestamp: 0x91b9349a
5028a0.1c28: Image Version: 10.0
5128a0.1c28: SizeOfImage: 0x2a4000 (2768896)
5228a0.1c28: Resource Dir: 0x27e000 LB 0x548
5328a0.1c28: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
5428a0.1c28: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
5528a0.1c28: ProductName: Microsoft® Windows® Operating System
5628a0.1c28: ProductVersion: 10.0.18362.997
5728a0.1c28: FileVersion: 10.0.18362.997 (WinBuild.160101.0800)
5828a0.1c28: FileDescription: Windows NT BASE API Client DLL
5928a0.1c28: \SystemRoot\System32\apisetschema.dll:
6028a0.1c28: CreationTime: 2019-03-19T04:43:54.837151500Z
6128a0.1c28: LastWriteTime: 2019-03-19T04:43:54.837151500Z
6228a0.1c28: ChangeTime: 2020-07-22T06:57:41.022465900Z
6328a0.1c28: FileAttributes: 0x20
6428a0.1c28: Size: 0x1d028
6528a0.1c28: NT Headers: 0xc8
6628a0.1c28: Timestamp: 0xd6ced080
6728a0.1c28: Machine: 0x8664 - amd64
6828a0.1c28: Timestamp: 0xd6ced080
6928a0.1c28: Image Version: 10.0
7028a0.1c28: SizeOfImage: 0x1e000 (122880)
7128a0.1c28: Resource Dir: 0x1d000 LB 0x408
7228a0.1c28: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
7328a0.1c28: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
7428a0.1c28: ProductName: Microsoft® Windows® Operating System
7528a0.1c28: ProductVersion: 10.0.18362.1
7628a0.1c28: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
7728a0.1c28: FileDescription: ApiSet Schema DLL
7828a0.1c28: NtOpenDirectoryObject failed on \Driver: 0xc0000022
7928a0.1c28: supR3HardenedWinFindAdversaries: 0x0
8028a0.1c28: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
8128a0.1c28: Calling main()
8228a0.1c28: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
8328a0.1c28: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
8428a0.1c28: SUPR3HardenedMain: Respawn #1
8528a0.1c28: System32: \Device\HarddiskVolume3\Windows\System32
8628a0.1c28: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
8728a0.1c28: KnownDllPath: C:\Windows\System32
8828a0.1c28: supR3HardenedWinInit: Performing a limited self purification...
8928a0.1c28: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
9028a0.1c28: *0000000000000000-0000000000e2ffff 0x0001/0x0000 0x0000000
9128a0.1c28: *0000000000e30000-0000000000e3ffff 0x0004/0x0004 0x0040000
9228a0.1c28: 0000000000e40000-0000000000e4ffff 0x0001/0x0000 0x0000000
9328a0.1c28: *0000000000e50000-0000000000e6afff 0x0002/0x0002 0x0040000
9428a0.1c28: 0000000000e6b000-0000000000e6ffff 0x0001/0x0000 0x0000000
9528a0.1c28: *0000000000e70000-0000000000f28fff 0x0000/0x0004 0x0020000
9628a0.1c28: 0000000000f29000-0000000000f2bfff 0x0104/0x0004 0x0020000
9728a0.1c28: 0000000000f2c000-0000000000f6ffff 0x0004/0x0004 0x0020000
9828a0.1c28: *0000000000f70000-0000000000f73fff 0x0002/0x0002 0x0040000
9928a0.1c28: 0000000000f74000-0000000000f7ffff 0x0001/0x0000 0x0000000
10028a0.1c28: *0000000000f80000-0000000000f81fff 0x0004/0x0004 0x0020000
10128a0.1c28: 0000000000f82000-0000000000f8ffff 0x0001/0x0000 0x0000000
10228a0.1c28: *0000000000f90000-0000000000f91fff 0x0004/0x0004 0x0020000
10328a0.1c28: 0000000000f92000-0000000000fc1fff 0x0000/0x0004 0x0020000
10428a0.1c28: 0000000000fc2000-0000000000ffffff 0x0001/0x0000 0x0000000
10528a0.1c28: *0000000001000000-00000000011cafff 0x0000/0x0004 0x0020000
10628a0.1c28: 00000000011cb000-00000000011cdfff 0x0004/0x0004 0x0020000
10728a0.1c28: 00000000011ce000-00000000011fffff 0x0000/0x0004 0x0020000
10828a0.1c28: *0000000001200000-00000000012c6fff 0x0002/0x0002 0x0040000
10928a0.1c28: 00000000012c7000-000000000131ffff 0x0001/0x0000 0x0000000
11028a0.1c28: *0000000001320000-0000000001324fff 0x0004/0x0004 0x0020000
11128a0.1c28: 0000000001325000-000000000141ffff 0x0000/0x0004 0x0020000
11228a0.1c28: *0000000001420000-000000000143cfff 0x0004/0x0004 0x0020000
11328a0.1c28: 000000000143d000-000000000151ffff 0x0000/0x0004 0x0020000
11428a0.1c28: 0000000001520000-00000000015dffff 0x0001/0x0000 0x0000000
11528a0.1c28: *00000000015e0000-00000000015eefff 0x0004/0x0004 0x0020000
11628a0.1c28: 00000000015ef000-00000000015effff 0x0000/0x0004 0x0020000
11728a0.1c28: *00000000015f0000-00000000015f5fff 0x0000/0x0004 0x0020000
11828a0.1c28: 00000000015f6000-00000000017e6fff 0x0004/0x0004 0x0020000
11928a0.1c28: 00000000017e7000-00000000017e7fff 0x0000/0x0004 0x0020000
12028a0.1c28: 00000000017e8000-000000007ffdffff 0x0001/0x0000 0x0000000
12128a0.1c28: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
12228a0.1c28: 000000007ffe1000-000000007ffe1fff 0x0001/0x0000 0x0000000
12328a0.1c28: *000000007ffe2000-000000007ffe2fff 0x0002/0x0002 0x0020000
12428a0.1c28: 000000007ffe3000-00007ff47611ffff 0x0001/0x0000 0x0000000
12528a0.1c28: *00007ff476120000-00007ff476124fff 0x0002/0x0002 0x0040000
12628a0.1c28: 00007ff476125000-00007ff47621ffff 0x0000/0x0002 0x0040000
12728a0.1c28: *00007ff476220000-00007ff57623ffff 0x0000/0x0004 0x0020000
12828a0.1c28: *00007ff576240000-00007ff57823ffff 0x0000/0x0004 0x0020000
12928a0.1c28: 00007ff578240000-00007ff578240fff 0x0004/0x0004 0x0020000
13028a0.1c28: 00007ff578241000-00007ff57824ffff 0x0001/0x0000 0x0000000
13128a0.1c28: *00007ff578250000-00007ff578250fff 0x0002/0x0002 0x0040000
13228a0.1c28: 00007ff578251000-00007ff57825ffff 0x0001/0x0000 0x0000000
13328a0.1c28: *00007ff578260000-00007ff578292fff 0x0002/0x0002 0x0040000
13428a0.1c28: 00007ff578293000-00007ff7b0f7ffff 0x0001/0x0000 0x0000000
13528a0.1c28: *00007ff7b0f80000-00007ff7b0f80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
13628a0.1c28: 00007ff7b0f81000-00007ff7b0ff6fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
13728a0.1c28: 00007ff7b0ff7000-00007ff7b0ff7fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
13828a0.1c28: 00007ff7b0ff8000-00007ff7b103ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
13928a0.1c28: 00007ff7b1040000-00007ff7b1042fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14028a0.1c28: 00007ff7b1043000-00007ff7b1045fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14128a0.1c28: 00007ff7b1046000-00007ff7b1048fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14228a0.1c28: 00007ff7b1049000-00007ff7b1049fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14328a0.1c28: 00007ff7b104a000-00007ff7b104bfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14428a0.1c28: 00007ff7b104c000-00007ff7b104cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14528a0.1c28: 00007ff7b104d000-00007ff7b1095fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
14628a0.1c28: 00007ff7b1096000-00007ffc412fffff 0x0001/0x0000 0x0000000
14728a0.1c28: *00007ffc41300000-00007ffc41300fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
14828a0.1c28: 00007ffc41301000-00007ffc41405fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
14928a0.1c28: 00007ffc41406000-00007ffc41568fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
15028a0.1c28: 00007ffc41569000-00007ffc4156cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
15128a0.1c28: 00007ffc4156d000-00007ffc4156dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
15228a0.1c28: 00007ffc4156e000-00007ffc415a3fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
15328a0.1c28: 00007ffc415a4000-00007ffc42c4ffff 0x0001/0x0000 0x0000000
15428a0.1c28: *00007ffc42c50000-00007ffc42c50fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
15528a0.1c28: 00007ffc42c51000-00007ffc42cc5fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
15628a0.1c28: 00007ffc42cc6000-00007ffc42cf7fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
15728a0.1c28: 00007ffc42cf8000-00007ffc42cf8fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
15828a0.1c28: 00007ffc42cf9000-00007ffc42cf9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
15928a0.1c28: 00007ffc42cfa000-00007ffc42d01fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
16028a0.1c28: 00007ffc42d02000-00007ffc4437ffff 0x0001/0x0000 0x0000000
16128a0.1c28: *00007ffc44380000-00007ffc44380fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16228a0.1c28: 00007ffc44381000-00007ffc44497fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16328a0.1c28: 00007ffc44498000-00007ffc444defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16428a0.1c28: 00007ffc444df000-00007ffc444dffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16528a0.1c28: 00007ffc444e0000-00007ffc444e1fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16628a0.1c28: 00007ffc444e2000-00007ffc444eafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16728a0.1c28: 00007ffc444eb000-00007ffc4456ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
16828a0.1c28: 00007ffc44570000-00007ffffffeffff 0x0001/0x0000 0x0000000
16928a0.1c28: kernel32.dll: timestamp 0xce6bbd73 (rc=VINF_SUCCESS)
17028a0.1c28: kernelbase.dll: timestamp 0x91b9349a (rc=VINF_SUCCESS)
17128a0.1c28: VirtualBoxVM.exe: timestamp 0x5f08d7bc (rc=VINF_SUCCESS)
17228a0.1c28: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
17328a0.1c28: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
17428a0.1c28: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0
17528a0.1c28: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
17628a0.1c28: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
17728a0.1c28: supR3HardNtEnableThreadCreationEx:
17828a0.1c28: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc443f1770 pvNtTerminateThread=00007ffc4441cac0
17928a0.1c28: supR3HardenedWinDoReSpawn(1): New child 2b18.2b1c [kernel32].
18028a0.1c28: supR3HardNtChildGatherData: PebBaseAddress=0000000000958000 cbPeb=0x388
18128a0.1c28: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffc44380000 uNtDllChildAddr=00007ffc44380000
18228a0.1c28: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffc443f1770
18328a0.1c28: supR3HardenedWinSetupChildInit: Initial context:
184 rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7b0f87900 rdx=0000000000958000
185 rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
186 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
187 r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
188 rip=00007ffc443ece30 rsp=000000000075fa78 rbp=0000000000000000 ctxflags=0010001b
189 cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
190 P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
191 dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
192 dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
193 lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
19428a0.1c28: supR3HardenedWinSetupChildInit: Start child.
19528a0.1c28: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
19628a0.1c28: supR3HardNtChildPurify: Startup delay kludge #1/0: 259 ms, 26 sleeps
19728a0.1c28: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
19828a0.1c28: *0000000000000000-000000000061ffff 0x0001/0x0000 0x0000000
19928a0.1c28: *0000000000620000-000000000063ffff 0x0004/0x0004 0x0020000
20028a0.1c28: *0000000000640000-000000000065afff 0x0002/0x0002 0x0040000
20128a0.1c28: 000000000065b000-000000000065ffff 0x0001/0x0000 0x0000000
20228a0.1c28: *0000000000660000-000000000075afff 0x0000/0x0004 0x0020000
20328a0.1c28: 000000000075b000-000000000075dfff 0x0104/0x0004 0x0020000
20428a0.1c28: 000000000075e000-000000000075ffff 0x0004/0x0004 0x0020000
20528a0.1c28: *0000000000760000-0000000000763fff 0x0002/0x0002 0x0040000
20628a0.1c28: 0000000000764000-000000000076ffff 0x0001/0x0000 0x0000000
20728a0.1c28: *0000000000770000-0000000000771fff 0x0004/0x0004 0x0020000
20828a0.1c28: 0000000000772000-00000000007fffff 0x0001/0x0000 0x0000000
20928a0.1c28: *0000000000800000-0000000000957fff 0x0000/0x0004 0x0020000
21028a0.1c28: 0000000000958000-000000000095afff 0x0004/0x0004 0x0020000
21128a0.1c28: 000000000095b000-00000000009fffff 0x0000/0x0004 0x0020000
21228a0.1c28: 0000000000a00000-000000007ffdffff 0x0001/0x0000 0x0000000
21328a0.1c28: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
21428a0.1c28: 000000007ffe1000-000000007ffe1fff 0x0001/0x0000 0x0000000
21528a0.1c28: *000000007ffe2000-000000007ffe2fff 0x0002/0x0002 0x0020000
21628a0.1c28: 000000007ffe3000-00007ff57f0cffff 0x0001/0x0000 0x0000000
21728a0.1c28: *00007ff57f0d0000-00007ff57f0d0fff 0x0002/0x0002 0x0040000
21828a0.1c28: 00007ff57f0d1000-00007ff57f0dffff 0x0001/0x0000 0x0000000
21928a0.1c28: *00007ff57f0e0000-00007ff57f112fff 0x0002/0x0002 0x0040000
22028a0.1c28: 00007ff57f113000-00007ff7b0f7ffff 0x0001/0x0000 0x0000000
22128a0.1c28: *00007ff7b0f80000-00007ff7b0f80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22228a0.1c28: 00007ff7b0f81000-00007ff7b0ff6fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22328a0.1c28: 00007ff7b0ff7000-00007ff7b0ff7fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22428a0.1c28: 00007ff7b0ff8000-00007ff7b103ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22528a0.1c28: 00007ff7b1040000-00007ff7b1040fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22628a0.1c28: 00007ff7b1041000-00007ff7b1041fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22728a0.1c28: 00007ff7b1042000-00007ff7b1046fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22828a0.1c28: 00007ff7b1047000-00007ff7b1047fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
22928a0.1c28: 00007ff7b1048000-00007ff7b1048fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
23028a0.1c28: 00007ff7b1049000-00007ff7b104cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
23128a0.1c28: 00007ff7b104d000-00007ff7b1095fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
23228a0.1c28: 00007ff7b1096000-00007ffc4437ffff 0x0001/0x0000 0x0000000
23328a0.1c28: *00007ffc44380000-00007ffc44380fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23428a0.1c28: 00007ffc44381000-00007ffc44497fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23528a0.1c28: 00007ffc44498000-00007ffc444defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23628a0.1c28: 00007ffc444df000-00007ffc444eafff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23728a0.1c28: 00007ffc444eb000-00007ffc444f9fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23828a0.1c28: 00007ffc444fa000-00007ffc444fafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
23928a0.1c28: 00007ffc444fb000-00007ffc444fdfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
24028a0.1c28: 00007ffc444fe000-00007ffc4456ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
24128a0.1c28: 00007ffc44570000-00007ffffffeffff 0x0001/0x0000 0x0000000
24228a0.1c28: supR3HardNtChildPurify: Done after 264 ms and 0 fixes (loop #0).
2432b18.2b1c: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa047bb00
2442b18.2b1c: supR3HardenedVmProcessInit: uNtDllAddr=00007ffc44380000 g_uNtVerCombined=0xa047bb00 (stack ~000000000075f508)
2452b18.2b1c: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
2462b18.2b1c: New simple heap: #1 0000000000b00000 LB 0x400000 (for 2031616 allocation)
2472b18.2b1c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
24828a0.1c28: supR3HardNtEnableThreadCreationEx:
2492b18.2b1c: System32: \Device\HarddiskVolume3\Windows\System32
2502b18.2b1c: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
2512b18.2b1c: KnownDllPath: C:\Windows\System32
2522b18.2b1c: supR3HardenedVmProcessInit: Opening vboxdrv stub...
2532b18.2b1c: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
2542b18.2b1c: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
2552b18.2b1c: Registered Dll notification callback with NTDLL.
2562b18.2b1c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
2572b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
2582b18.2b1c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
2592b18.2b1c: supR3HardenedDllNotificationCallback: load 00007ffc41300000 LB 0x002a4000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
2602b18.2b1c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
2612b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
2622b18.2b1c: supR3HardenedDllNotificationCallback: load 00007ffc42c50000 LB 0x000b2000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
2632b18.2b1c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
2642b18.2b1c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\KERNEL32.DLL'
2652b18.2b1c: supR3HardenedDllNotificationCallback: load 00007ff7b0f80000 LB 0x00116000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
2662b18.2b1c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
2672b18.2b1c: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
2682b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
2692b18.2b1c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc443f1770 pvNtTerminateThread=00007ffc4441cac0
2702b18.2b1c: \SystemRoot\System32\ntdll.dll:
2712b18.2b1c: CreationTime: 2020-07-22T06:39:52.722087600Z
27228a0.1c28: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 53 ms.
2732b18.2b1c: LastWriteTime: 2020-07-22T06:39:52.737736600Z
2742b18.2b1c: ChangeTime: 2020-07-22T06:57:41.475577900Z
2752b18.2b1c: FileAttributes: 0x20
2762b18.2b1c: Size: 0x1e8460
2772b18.2b1c: NT Headers: 0xd8
2782b18.2b1c: Timestamp: 0xb29ecf52
2792b18.2b1c: Machine: 0x8664 - amd64
2802b18.2b1c: Timestamp: 0xb29ecf52
2812b18.2b1c: Image Version: 10.0
2822b18.2b1c: SizeOfImage: 0x1f0000 (2031616)
2832b18.2b1c: Resource Dir: 0x17f000 LB 0x6f310
2842b18.2b1c: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
2852b18.2b1c: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
2862b18.2b1c: ProductName: Microsoft® Windows® Operating System
2872b18.2b1c: ProductVersion: 10.0.18362.815
2882b18.2b1c: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
2892b18.2b1c: FileDescription: NT Layer DLL
2902b18.2b1c: \SystemRoot\System32\kernel32.dll:
2912b18.2b1c: CreationTime: 2020-07-22T06:39:35.572371500Z
2922b18.2b1c: LastWriteTime: 2020-07-22T06:39:35.572371500Z
2932b18.2b1c: ChangeTime: 2020-07-22T06:57:41.022465900Z
2942b18.2b1c: FileAttributes: 0x20
2952b18.2b1c: Size: 0xb0498
2962b18.2b1c: NT Headers: 0xe8
2972b18.2b1c: Timestamp: 0xce6bbd73
2982b18.2b1c: Machine: 0x8664 - amd64
2992b18.2b1c: Timestamp: 0xce6bbd73
3002b18.2b1c: Image Version: 10.0
3012b18.2b1c: SizeOfImage: 0xb2000 (729088)
3022b18.2b1c: Resource Dir: 0xb0000 LB 0x520
3032b18.2b1c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
3042b18.2b1c: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
3052b18.2b1c: ProductName: Microsoft® Windows® Operating System
3062b18.2b1c: ProductVersion: 10.0.18362.959
3072b18.2b1c: FileVersion: 10.0.18362.959 (WinBuild.160101.0800)
3082b18.2b1c: FileDescription: Windows NT BASE API Client DLL
3092b18.2b1c: \SystemRoot\System32\KernelBase.dll:
3102b18.2b1c: CreationTime: 2020-07-22T06:57:20.479306600Z
3112b18.2b1c: LastWriteTime: 2020-07-22T06:57:20.526169200Z
3122b18.2b1c: ChangeTime: 2020-07-22T06:59:21.051113100Z
3132b18.2b1c: FileAttributes: 0x20
3142b18.2b1c: Size: 0x2a3868
3152b18.2b1c: NT Headers: 0xf8
3162b18.2b1c: Timestamp: 0x91b9349a
3172b18.2b1c: Machine: 0x8664 - amd64
3182b18.2b1c: Timestamp: 0x91b9349a
3192b18.2b1c: Image Version: 10.0
3202b18.2b1c: SizeOfImage: 0x2a4000 (2768896)
3212b18.2b1c: Resource Dir: 0x27e000 LB 0x548
3222b18.2b1c: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
3232b18.2b1c: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
3242b18.2b1c: ProductName: Microsoft® Windows® Operating System
3252b18.2b1c: ProductVersion: 10.0.18362.997
3262b18.2b1c: FileVersion: 10.0.18362.997 (WinBuild.160101.0800)
3272b18.2b1c: FileDescription: Windows NT BASE API Client DLL
3282b18.2b1c: \SystemRoot\System32\apisetschema.dll:
3292b18.2b1c: CreationTime: 2019-03-19T04:43:54.837151500Z
3302b18.2b1c: LastWriteTime: 2019-03-19T04:43:54.837151500Z
3312b18.2b1c: ChangeTime: 2020-07-22T06:57:41.022465900Z
3322b18.2b1c: FileAttributes: 0x20
3332b18.2b1c: Size: 0x1d028
3342b18.2b1c: NT Headers: 0xc8
3352b18.2b1c: Timestamp: 0xd6ced080
3362b18.2b1c: Machine: 0x8664 - amd64
3372b18.2b1c: Timestamp: 0xd6ced080
3382b18.2b1c: Image Version: 10.0
3392b18.2b1c: SizeOfImage: 0x1e000 (122880)
3402b18.2b1c: Resource Dir: 0x1d000 LB 0x408
3412b18.2b1c: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
3422b18.2b1c: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
3432b18.2b1c: ProductName: Microsoft® Windows® Operating System
3442b18.2b1c: ProductVersion: 10.0.18362.1
3452b18.2b1c: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
3462b18.2b1c: FileDescription: ApiSet Schema DLL
3472b18.2b1c: NtOpenDirectoryObject failed on \Driver: 0xc0000022
3482b18.2b1c: supR3HardenedWinFindAdversaries: 0x0
3492b18.2b1c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
3502b18.2b1c: Calling main()
3512b18.2b1c: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
3522b18.2b1c: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
3532b18.2b1c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
3542b18.2b1c: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
3552b18.2b1c: SUPR3HardenedMain: Respawn #2
3562b18.2b1c: supR3HardNtEnableThreadCreationEx:
3572b18.2b1c: supR3HardenedDllNotificationCallback: load 00007ffc435d0000 LB 0x00120000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
3582b18.2b1c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
3592b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
3602b18.2b1c: supR3HardenedDllNotificationCallback: load 00007ffc42a60000 LB 0x00097000 C:\Windows\System32\sechost.dll [fFlags=0x0]
3612b18.2b1c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
3622b18.2b1c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
3632b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
3642b18.2b1c: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
3652b18.2b1c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntdll.dll)
3662b18.2b1c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntdll.dll
3672b18.2b1c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3682b18.2b1c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3692b18.2b1c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
3702b18.2b1c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3712b18.2b1c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc44380000 'C:\Windows\System32\ntdll.dll'
3722b18.2b1c: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc443f1770 pvNtTerminateThread=00007ffc4441cac0
3732b18.2b1c: supR3HardenedWinDoReSpawn(2): New child fc8.25d4 [kernel32].
3742b18.2b1c: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
3752b18.2b1c: supR3HardNtChildGatherData: PebBaseAddress=000000000083c000 cbPeb=0x388
3762b18.2b1c: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffc44380000 uNtDllChildAddr=00007ffc44380000
3772b18.2b1c: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffc443f1770
3782b18.2b1c: supR3HardenedWinSetupChildInit: Initial context:
379 rax=0000000000000000 rbx=0000000000000000 rcx=00007ff7b0f87900 rdx=000000000083c000
380 rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
381 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
382 r14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
383 rip=00007ffc443ece30 rsp=0000000000afffa8 rbp=0000000000000000 ctxflags=0010001b
384 cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f80
385 P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
386 dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
387 dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
388 lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
3892b18.2b1c: kernel32.dll: timestamp 0xce6bbd73 (rc=VINF_SUCCESS)
3902b18.2b1c: supR3HardenedWinSetupChildInit: Start child.
3912b18.2b1c: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
3922b18.2b1c: supR3HardNtChildPurify: Startup delay kludge #1/0: 268 ms, 26 sleeps
3932b18.2b1c: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
3942b18.2b1c: *0000000000000000-000000000076ffff 0x0001/0x0000 0x0000000
3952b18.2b1c: *0000000000770000-000000000078ffff 0x0004/0x0004 0x0020000
3962b18.2b1c: *0000000000790000-00000000007aafff 0x0002/0x0002 0x0040000
3972b18.2b1c: 00000000007ab000-00000000007affff 0x0001/0x0000 0x0000000
3982b18.2b1c: *00000000007b0000-00000000007b3fff 0x0002/0x0002 0x0040000
3992b18.2b1c: 00000000007b4000-00000000007bffff 0x0001/0x0000 0x0000000
4002b18.2b1c: *00000000007c0000-00000000007c1fff 0x0004/0x0004 0x0020000
4012b18.2b1c: 00000000007c2000-00000000007fffff 0x0001/0x0000 0x0000000
4022b18.2b1c: *0000000000800000-000000000083bfff 0x0000/0x0004 0x0020000
4032b18.2b1c: 000000000083c000-000000000083efff 0x0004/0x0004 0x0020000
4042b18.2b1c: 000000000083f000-00000000009fffff 0x0000/0x0004 0x0020000
4052b18.2b1c: *0000000000a00000-0000000000afafff 0x0000/0x0004 0x0020000
4062b18.2b1c: 0000000000afb000-0000000000afdfff 0x0104/0x0004 0x0020000
4072b18.2b1c: 0000000000afe000-0000000000afffff 0x0004/0x0004 0x0020000
4082b18.2b1c: 0000000000b00000-000000007ffdffff 0x0001/0x0000 0x0000000
4092b18.2b1c: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
4102b18.2b1c: 000000007ffe1000-000000007ffe1fff 0x0001/0x0000 0x0000000
4112b18.2b1c: *000000007ffe2000-000000007ffe2fff 0x0002/0x0002 0x0020000
4122b18.2b1c: 000000007ffe3000-00007ff5704bffff 0x0001/0x0000 0x0000000
4132b18.2b1c: *00007ff5704c0000-00007ff5704c0fff 0x0002/0x0002 0x0040000
4142b18.2b1c: 00007ff5704c1000-00007ff5704cffff 0x0001/0x0000 0x0000000
4152b18.2b1c: *00007ff5704d0000-00007ff570502fff 0x0002/0x0002 0x0040000
4162b18.2b1c: 00007ff570503000-00007ff7b0f7ffff 0x0001/0x0000 0x0000000
4172b18.2b1c: *00007ff7b0f80000-00007ff7b0f80fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4182b18.2b1c: 00007ff7b0f81000-00007ff7b0ff6fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4192b18.2b1c: 00007ff7b0ff7000-00007ff7b0ff7fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4202b18.2b1c: 00007ff7b0ff8000-00007ff7b103ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4212b18.2b1c: 00007ff7b1040000-00007ff7b1040fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4222b18.2b1c: 00007ff7b1041000-00007ff7b1041fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4232b18.2b1c: 00007ff7b1042000-00007ff7b1046fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4242b18.2b1c: 00007ff7b1047000-00007ff7b1047fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4252b18.2b1c: 00007ff7b1048000-00007ff7b1048fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4262b18.2b1c: 00007ff7b1049000-00007ff7b104cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4272b18.2b1c: 00007ff7b104d000-00007ff7b1095fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
4282b18.2b1c: 00007ff7b1096000-00007ffc4437ffff 0x0001/0x0000 0x0000000
4292b18.2b1c: *00007ffc44380000-00007ffc44380fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4302b18.2b1c: 00007ffc44381000-00007ffc44497fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4312b18.2b1c: 00007ffc44498000-00007ffc444defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4322b18.2b1c: 00007ffc444df000-00007ffc444eafff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4332b18.2b1c: 00007ffc444eb000-00007ffc444f9fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4342b18.2b1c: 00007ffc444fa000-00007ffc444fafff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4352b18.2b1c: 00007ffc444fb000-00007ffc444fdfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4362b18.2b1c: 00007ffc444fe000-00007ffc4456ffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
4372b18.2b1c: 00007ffc44570000-00007ffffffeffff 0x0001/0x0000 0x0000000
4382b18.2b1c: VirtualBoxVM.exe: timestamp 0x5f08d7bc (rc=VINF_SUCCESS)
4392b18.2b1c: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
4402b18.2b1c: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
4412b18.2b1c: supR3HardNtChildPurify: Done after 283 ms and 0 fixes (loop #0).
442fc8.25d4: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa047bb00
443fc8.25d4: supR3HardenedVmProcessInit: uNtDllAddr=00007ffc44380000 g_uNtVerCombined=0xa047bb00 (stack ~0000000000affa38)
444fc8.25d4: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
445fc8.25d4: New simple heap: #1 0000000000c00000 LB 0x400000 (for 2031616 allocation)
4462b18.2b1c: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000b00000 LB 0x400000)
4472b18.2b1c: supR3HardNtEnableThreadCreationEx:
448fc8.25d4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
449fc8.25d4: System32: \Device\HarddiskVolume3\Windows\System32
450fc8.25d4: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
451fc8.25d4: KnownDllPath: C:\Windows\System32
452fc8.25d4: supR3HardenedVmProcessInit: Opening vboxdrv...
453fc8.25d4: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
454fc8.25d4: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
455fc8.25d4: Registered Dll notification callback with NTDLL.
456fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel32.dll)
457fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel32.dll
458fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
459fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41300000 LB 0x002a4000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
460fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\KernelBase.dll)
461fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
462fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42c50000 LB 0x000b2000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
463fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
464fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\KERNEL32.DLL'
465fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ff7b0f80000 LB 0x00116000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
466fc8.25d4: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
467fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
468fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
469fc8.25d4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffc443f1770 pvNtTerminateThread=00007ffc4441cac0
4702b18.2b1c: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 63 ms.
471fc8.25d4: \SystemRoot\System32\ntdll.dll:
472fc8.25d4: CreationTime: 2020-07-22T06:39:52.722087600Z
473fc8.25d4: LastWriteTime: 2020-07-22T06:39:52.737736600Z
474fc8.25d4: ChangeTime: 2020-07-22T06:57:41.475577900Z
475fc8.25d4: FileAttributes: 0x20
476fc8.25d4: Size: 0x1e8460
477fc8.25d4: NT Headers: 0xd8
478fc8.25d4: Timestamp: 0xb29ecf52
479fc8.25d4: Machine: 0x8664 - amd64
480fc8.25d4: Timestamp: 0xb29ecf52
481fc8.25d4: Image Version: 10.0
482fc8.25d4: SizeOfImage: 0x1f0000 (2031616)
483fc8.25d4: Resource Dir: 0x17f000 LB 0x6f310
484fc8.25d4: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
485fc8.25d4: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]
486fc8.25d4: ProductName: Microsoft® Windows® Operating System
487fc8.25d4: ProductVersion: 10.0.18362.815
488fc8.25d4: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
489fc8.25d4: FileDescription: NT Layer DLL
490fc8.25d4: \SystemRoot\System32\kernel32.dll:
491fc8.25d4: CreationTime: 2020-07-22T06:39:35.572371500Z
492fc8.25d4: LastWriteTime: 2020-07-22T06:39:35.572371500Z
493fc8.25d4: ChangeTime: 2020-07-22T06:57:41.022465900Z
494fc8.25d4: FileAttributes: 0x20
495fc8.25d4: Size: 0xb0498
496fc8.25d4: NT Headers: 0xe8
497fc8.25d4: Timestamp: 0xce6bbd73
498fc8.25d4: Machine: 0x8664 - amd64
499fc8.25d4: Timestamp: 0xce6bbd73
500fc8.25d4: Image Version: 10.0
501fc8.25d4: SizeOfImage: 0xb2000 (729088)
502fc8.25d4: Resource Dir: 0xb0000 LB 0x520
503fc8.25d4: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
504fc8.25d4: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
505fc8.25d4: ProductName: Microsoft® Windows® Operating System
506fc8.25d4: ProductVersion: 10.0.18362.959
507fc8.25d4: FileVersion: 10.0.18362.959 (WinBuild.160101.0800)
508fc8.25d4: FileDescription: Windows NT BASE API Client DLL
509fc8.25d4: \SystemRoot\System32\KernelBase.dll:
510fc8.25d4: CreationTime: 2020-07-22T06:57:20.479306600Z
511fc8.25d4: LastWriteTime: 2020-07-22T06:57:20.526169200Z
512fc8.25d4: ChangeTime: 2020-07-22T06:59:21.051113100Z
513fc8.25d4: FileAttributes: 0x20
514fc8.25d4: Size: 0x2a3868
515fc8.25d4: NT Headers: 0xf8
516fc8.25d4: Timestamp: 0x91b9349a
517fc8.25d4: Machine: 0x8664 - amd64
518fc8.25d4: Timestamp: 0x91b9349a
519fc8.25d4: Image Version: 10.0
520fc8.25d4: SizeOfImage: 0x2a4000 (2768896)
521fc8.25d4: Resource Dir: 0x27e000 LB 0x548
522fc8.25d4: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
523fc8.25d4: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
524fc8.25d4: ProductName: Microsoft® Windows® Operating System
525fc8.25d4: ProductVersion: 10.0.18362.997
526fc8.25d4: FileVersion: 10.0.18362.997 (WinBuild.160101.0800)
527fc8.25d4: FileDescription: Windows NT BASE API Client DLL
528fc8.25d4: \SystemRoot\System32\apisetschema.dll:
529fc8.25d4: CreationTime: 2019-03-19T04:43:54.837151500Z
530fc8.25d4: LastWriteTime: 2019-03-19T04:43:54.837151500Z
531fc8.25d4: ChangeTime: 2020-07-22T06:57:41.022465900Z
532fc8.25d4: FileAttributes: 0x20
533fc8.25d4: Size: 0x1d028
534fc8.25d4: NT Headers: 0xc8
535fc8.25d4: Timestamp: 0xd6ced080
536fc8.25d4: Machine: 0x8664 - amd64
537fc8.25d4: Timestamp: 0xd6ced080
538fc8.25d4: Image Version: 10.0
539fc8.25d4: SizeOfImage: 0x1e000 (122880)
540fc8.25d4: Resource Dir: 0x1d000 LB 0x408
541fc8.25d4: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
542fc8.25d4: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
543fc8.25d4: ProductName: Microsoft® Windows® Operating System
544fc8.25d4: ProductVersion: 10.0.18362.1
545fc8.25d4: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
546fc8.25d4: FileDescription: ApiSet Schema DLL
547fc8.25d4: NtOpenDirectoryObject failed on \Driver: 0xc0000022
548fc8.25d4: supR3HardenedWinFindAdversaries: 0x0
549fc8.25d4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
550fc8.25d4: Calling main()
551fc8.25d4: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
552fc8.25d4: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox'
553fc8.25d4: '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
554fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
555fc8.25d4: SUPR3HardenedMain: Final process, opening VBoxDrv...
556fc8.25d4: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000c00000 LB 0x400000)
557fc8.25d4: supR3HardNtEnableThreadCreationEx:
558fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
559fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
560fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
561fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
562fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc341d0000 LB 0x00005000 C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
563fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
564fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
565fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
566fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc341d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
567fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
568fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
569fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc341d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
570fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc341d0000 'C:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
571fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
572fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msasn1.dll'.
573fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
574fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
575fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wintrust.dll)
576fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wintrust.dll
577fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
578fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
579fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll)
580fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
581fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
582fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
583fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msasn1.dll'.
584fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\crypt32.dll)
585fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\crypt32.dll
586fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
587fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
588fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msasn1.dll)
589fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msasn1.dll
590fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
591fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
592fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcrt.dll)
593fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
594fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
595fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
596fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
597fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
598fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42880000 LB 0x0009e000 C:\Windows\System32\msvcrt.dll [fFlags=0x0]
599fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
600fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc412b0000 LB 0x00012000 C:\Windows\System32\MSASN1.dll [fFlags=0x0]
601fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
602fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42100000 LB 0x000fa000 C:\Windows\System32\ucrtbase.dll [fFlags=0x0]
603fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll)
604fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ucrtbase.dll
605fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41fb0000 LB 0x00149000 C:\Windows\System32\CRYPT32.dll [fFlags=0x0]
606fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
607fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc435d0000 LB 0x00120000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
608fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
609fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42230000 LB 0x0005c000 C:\Windows\System32\Wintrust.dll [fFlags=0x0]
610fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
611fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
612fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
613fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-synch-l1-2-0'
614fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
615fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
616fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-fibers-l1-1-1'
617fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
618fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
619fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-fibers-l1-1-1'
620fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
621fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
622fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-synch-l1-2-0'
623fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
624fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
625fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-localization-l1-2-1'
626fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42230000 'C:\Windows\system32\Wintrust.dll'
627fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcrypt.dll)
628fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
629fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
630fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41de0000 LB 0x00026000 C:\Windows\System32\bcrypt.dll [fFlags=0x0]
631fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
632fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41de0000 'C:\Windows\system32\bcrypt.dll'
633fc8.25d4: bcrypt.dll loaded at 00007ffc41de0000, BCryptOpenAlgorithmProvider at 00007ffc41de4c70, preloading providers:
634fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll)
635fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
636fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
637fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc415b0000 LB 0x00080000 C:\Windows\System32\bcryptprimitives.dll [fFlags=0x0]
638fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
639fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc415b0000 'C:\Windows\system32\bcryptprimitives.dll'
640fc8.25d4: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000010cd0b0)
641fc8.25d4: BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000010ce620)
642fc8.25d4: BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=00000000010ce920)
643fc8.25d4: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=00000000010cec20)
644fc8.25d4: BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=00000000010cef20)
645fc8.25d4: BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000010cf220)
646fc8.25d4: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000010cf520)
647fc8.25d4: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=00000000010cf820)
648fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41dc0000 LB 0x00017000 C:\Windows\System32\CRYPTSP.dll [fFlags=0x0]
649fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptsp.dll)
650fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptsp.dll
651fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
652fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rsaenh.dll)
653fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
654fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
655fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
656fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
657fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
658fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
659fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc405a0000 LB 0x00033000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
660fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
661fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
662fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
663fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cryptbase.dll)
664fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptbase.dll
665fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc40c00000 LB 0x0000c000 C:\Windows\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
666fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
667fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
668fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
669fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
670fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
671fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
672fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\kernel32.dll'
673fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
674fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
675fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42230000 'C:\Windows\System32\WINTRUST.DLL'
676fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
677fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
678fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\CRYPT32.dll'
679fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc43de0000 LB 0x0001d000 C:\Windows\System32\imagehlp.dll [fFlags=0x0]
680fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'rpcrt4.dll'.
681fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imagehlp.dll)
682fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imagehlp.dll
683fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
684fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
685fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
686fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
687fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
688fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
689fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42a60000 LB 0x00097000 C:\Windows\System32\sechost.dll [fFlags=0x0]
690fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
691fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sechost.dll)
692fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sechost.dll
693fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
694fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
695fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gpapi.dll)
696fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gpapi.dll
697fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3fe20000 LB 0x00022000 C:\Windows\SYSTEM32\gpapi.dll [fFlags=0x0]
698fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
699fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc412d0000 LB 0x00023000 C:\Windows\System32\profapi.dll [fFlags=0x0]
700fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\profapi.dll)
701fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\profapi.dll
702fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
703fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
704fc8.25d4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\cryptnet.dll)
705fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cryptnet.dll
706fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
707fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
708fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
709fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
710fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
711fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
712fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
713fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
714fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
715fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
716fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
717fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
718fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
719fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
720fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
721fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
722fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
723fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc245d0000 LB 0x0002f000 C:\Windows\System32\cryptnet.dll [fFlags=0x0]
724fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
725fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
726fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
727fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
728fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
729fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
730fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
731fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
732fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
733fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
734fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
735fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
736fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
737fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
738fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
739fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
740fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
741fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
742fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
743fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
744fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
745fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
746fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
747fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
748fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
749fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
750fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
751fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
752fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
753fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
754fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
755fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc245d0000 'C:\Windows\System32\cryptnet.dll'
756fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42760000 LB 0x000a3000 C:\Windows\System32\advapi32.dll [fFlags=0x0]
757fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
758fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
759fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
760fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\advapi32.dll)
761fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\advapi32.dll
762fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
763fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
764fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
765fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
766fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
767fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume3\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
768fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\sechost.dll [lacks WinVerifyTrust]
769fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
770fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
771fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
772fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
773fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
774fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
775fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
776fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
777fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
778fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000010cfed0
779fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
780fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2F110B40CF67FEF4EFA84C23431B3B42233E381F
781fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
782fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
783fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc435d0000 'C:\Windows\System32\rpcrt4.dll'
784fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
785fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
786fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
787fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
788fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
789fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
790fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.997.cat'; file='\SystemRoot\System32\ntdll.dll'
791fc8.25d4: g_pfnWinVerifyTrust=00007ffc422361f0
792fc8.25d4: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
793fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
794fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
795fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
796fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
797fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
798fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
799fc8.25d4: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\crypt32.dll'
800fc8.25d4: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
801fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
802fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
803fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
804fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
805fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
806fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
807fc8.25d4: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\wintrust.dll'
808fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
809fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
810fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
811fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
812fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\advapi32.dll'
813fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000388 pwszName=\Device\HarddiskVolume3\Windows\System32\cryptnet.dll
814fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
815fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
816fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09032EBC3D9D9BDDC0EE4A6463C043296B79FF20
817fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
818fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
819fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
820fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.997.cat'; file='\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
821fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
822fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptnet.dll'
823fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
824fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
825fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
826fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\profapi.dll'
827fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
828fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
829fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
830fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gpapi.dll'
831fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
832fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
833fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
834fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\sechost.dll'
835fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
836fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
837fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
838fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imagehlp.dll'
839fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
840fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
841fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
842fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptbase.dll'
843fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
844fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
845fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
846fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
847fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
848fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rsaenh.dll'
849fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
850fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
851fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
852fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
853fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cryptsp.dll'
854fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
855fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
856fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll'
857fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
858fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
859fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll'
860fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
861fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
862fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ucrtbase.dll'
863fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
864fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
865fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll'
866fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
867fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
868fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msasn1.dll'
869fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
870fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
871fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll'
872fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
873fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll'
874fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
875fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe'
876fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
877fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
878fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\KernelBase.dll'
879fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
880fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
881fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel32.dll'
882fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\system32\crypt32.dll'
883fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
884fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
885fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
886fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
887fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
888fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
889fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
890fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
891fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
892fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
893fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
894fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
895fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root Certificate Authority 2014
896fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
897fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
898fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
899fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
900fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
901fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
902fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
903fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
904fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
905fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
906fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
907fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
908fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
909fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
910fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
911fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
912fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
913fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
914fc8.25d4: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
915fc8.25d4: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=32
916fc8.25d4: SUPR3HardenedMain: Load Runtime...
917fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
918fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
919fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
920fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
921fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
922fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
923fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
924fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
925fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
926fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
927fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
928fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
929fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ws2_32.dll) WinVerifyTrust
930fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
931fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
932fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
933fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
934fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
935fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
936fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
937fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
938fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
939fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
940fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
941fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
942fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
943fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
944fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
945fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
946fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
947fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
948fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll)
949fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
950fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
951fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
952fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
953fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
954fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
955fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
956fc8.25d4: supR3HardenedDllNotificationCallback: load 000000005c170000 LB 0x000d2000 C:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
957fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
958fc8.25d4: supR3HardenedDllNotificationCallback: load 000000005b5f0000 LB 0x00098000 C:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
959fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
960fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc432e0000 LB 0x0006f000 C:\Windows\System32\WS2_32.dll [fFlags=0x0]
961fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
962fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc192b0000 LB 0x005d6000 C:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
963fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
964fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
965fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
966fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
967fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
968fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
969fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
970fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
971fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
972fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
973fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
974fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
975fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
976fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
977fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
978fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
979fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
980fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
981fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
982fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
983fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
984fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
985fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
986fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
987fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
988fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
989fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
990fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
991fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
992fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
993fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
994fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
995fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
996fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
997fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
998fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
999fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1000fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1001fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
1002fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
1003fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1004fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1005fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1006fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1007fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1008fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1009fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1010fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1011fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1012fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1013fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1014fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1015fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1016fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1017fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1018fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1019fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1020fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1021fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1022fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1023fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1024fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1025fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1026fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1027fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1028fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1029fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1030fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1031fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1032fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1033fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1034fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1035fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1036fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1037fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1038fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1039fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1040fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1041fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1042fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1043fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
1044fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
1045fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1046fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1047fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1048fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1049fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1050fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1051fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1052fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1053fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1054fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1055fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1056fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1057fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1058fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1059fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1060fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1061fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1062fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1063fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1064fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1065fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1066fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1067fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1068fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1069fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1070fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1071fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1072fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1073fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1074fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1075fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1076fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1077fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1078fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1079fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1080fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1081fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1082fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1083fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1084fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1085fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1086fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1087fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1088fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1089fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1090fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1091fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1092fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1093fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1094fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1095fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1096fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1097fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1098fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1099fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1100fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1101fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1102fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1103fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1104fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1105fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1106fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1107fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1108fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1109fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1110fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1111fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1112fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1113fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1114fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1115fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1116fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1117fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1118fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1119fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1120fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1121fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1122fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1123fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1124fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1125fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
1126fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
1127fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1128fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1129fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1130fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1131fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1132fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1133fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1134fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1135fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1136fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1137fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1138fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
1139fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
1140fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc192b0000 'C:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
1141fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1142fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'
1143fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll
1144fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1145fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42230000 'C:\Windows\system32\Wintrust.dll'
1146fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
1147fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
1148fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1149fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1150fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1151fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1152fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\system32\crypt32.dll'
1153fc8.25d4: SUPR3HardenedMain: Load TrustedMain...
1154fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1155fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
1156fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'uicommon.dll'.
1157fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
1158fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcp100.dll'.
1159fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcr100.dll'.
1160fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5corevbox.dll'.
1161fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5guivbox.dll'.
1162fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5widgetsvbox.dll'.
1163fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
1164fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
1165fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'ole32.dll'.
1166fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'oleaut32.dll'.
1167fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'winmm.dll'.
1168fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll) WinVerifyTrust
1169fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
1170fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
1171fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
1172fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1173fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1174fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'winmmbase.dll'.
1175fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
1176fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmm.dll) WinVerifyTrust
1177fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmm.dll
1178fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
1179fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
1180fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1181fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1182fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
1183fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
1184fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
1185fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1186fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1187fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winmmbase.dll)
1188fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winmmbase.dll
1189fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1190fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1191fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
1192fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1193fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
1194fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
1195fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1196fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
1197fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
1198fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
1199fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleaut32.dll) WinVerifyTrust
1200fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
1201fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1202fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1203fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1204fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1205fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
1206fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
1207fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1208fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
1209fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'bcryptprimitives.dll'.
1210fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\combase.dll)
1211fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\combase.dll
1212fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
1213fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
1214fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1215fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll)
1216fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
1217fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
1218fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
1219fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
1220fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1221fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1222fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1223fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1224fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
1225fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'gdi32.dll'.
1226fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'user32.dll'.
1227fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #58 'combase.dll'.
1228fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ole32.dll) WinVerifyTrust
1229fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ole32.dll
1230fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1231fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1232fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
1233fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
1234fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [lacks WinVerifyTrust]
1235fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1236fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1237fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1238fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
1239fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
1240fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\user32.dll)
1241fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\user32.dll
1242fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1243fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1244fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1245fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'win32u.dll'.
1246fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32.dll)
1247fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32.dll
1248fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1249fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1250fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
1251fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
1252fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1253fc8.25d4: '\Device\HarddiskVolume3\Windows\System32\win32u.dll' has no imports
1254fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\win32u.dll)
1255fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\win32u.dll
1256fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1257fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1258fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1259fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
1260fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
1261fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
1262fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1263fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1264fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
1265fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'gdi32.dll'.
1266fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\user32.dll) WinVerifyTrust
1267fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
1268fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
1269fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1270fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1271fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1272fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
1273fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
1274fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [lacks WinVerifyTrust]
1275fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1276fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
1277fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
1278fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
1279fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
1280fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
1281fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
1282fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1283fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1284fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1285fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1286fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1287fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1288fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1289fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'.
1290fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
1291fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
1292fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
1293fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
1294fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
1295fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
1296fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
1297fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
1298fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll)
1299fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
1300fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1301fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1302fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'.
1303fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
1304fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
1305fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
1306fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1307fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
1308fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
1309fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
1310fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll)
1311fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
1312fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1313fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1314fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1315fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
1316fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
1317fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
1318fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
1319fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
1320fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
1321fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
1322fc8.25d4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll)
1323fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
1324fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1325fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1326fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1327fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1328fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
1329fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
1330fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
1331fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
1332fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1333fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #77 'user32.dll'.
1334fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #79 'gdi32.dll'.
1335fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shell32.dll)
1336fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shell32.dll
1337fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1338fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1339fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
1340fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1341fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1342fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
1343fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1344fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1345fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1346fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1347fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1348fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1349fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1350fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1351fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1352fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1353fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
1354fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
1355fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1356fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1357fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
1358fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1359fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1360fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1361fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1362fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1363fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1364fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1365fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1366fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'.
1367fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1368fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
1369fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1370fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
1371fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'glu32.dll'.
1372fc8.25d4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\opengl32.dll)
1373fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\opengl32.dll
1374fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1375fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1376fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
1377fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1378fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1379fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1380fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1381fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
1382fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
1383fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
1384fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
1385fc8.25d4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1386fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\mpr.dll)
1387fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\mpr.dll
1388fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
1389fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
1390fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
1391fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1392fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1393fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
1394fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1395fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1396fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
1397fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
1398fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
1399fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [lacks WinVerifyTrust]
1400fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1401fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1402fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1403fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
1404fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
1405fc8.25d4: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1406fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1407fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
1408fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'opengl32.dll'.
1409fc8.25d4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\glu32.dll)
1410fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\glu32.dll
1411fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1412fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1413fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1414fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1415fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1416fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1417fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1418fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1419fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
1420fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1421fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1422fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
1423fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1424fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1425fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1426fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1427fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1428fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1429fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1430fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1431fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
1432fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1433fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1434fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1435fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1436fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1437fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
1438fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1439fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
1440fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
1441fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
1442fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
1443fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
1444fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
1445fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
1446fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
1447fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1448fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1449fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [redoing WinVerifyTrust]
1450fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1451fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1452fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1453fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1454fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
1455fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
1456fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
1457fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
1458fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [lacks WinVerifyTrust]
1459fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1460fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1461fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
1462fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1463fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1464fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
1465fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1466fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1467fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1468fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1469fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1470fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1471fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1472fc8.25d4: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'
1473fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1474fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1475fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
1476fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1477fc8.25d4: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'
1478fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1479fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1480fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
1481fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1482fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
1483fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
1484fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
1485fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
1486fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uicommon.dll'...
1487fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\uicommon.dll' [rcNtRedir=0xc0150008]
1488fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1489fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
1490fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcr100.dll'.
1491fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
1492fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
1493fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5widgetsvbox.dll'.
1494fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
1495fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
1496fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ole32.dll'.
1497fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
1498fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
1499fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll) WinVerifyTrust
1500fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
1501fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1502fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1503fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll [redoing WinVerifyTrust]
1504fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000470 pwszName=\Device\HarddiskVolume3\Windows\System32\opengl32.dll
1505fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
1506fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
1507fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0837440FAE05EB650168FFA2D15E73182F6A3A26
1508fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1509fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1510fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
1511fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
1512fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
1513fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1514fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1515fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
1516fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1517fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1518fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
1519fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1520fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1521fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [lacks WinVerifyTrust]
1522fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1523fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1524fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
1525fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1526fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1527fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
1528fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1529fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1530fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
1531fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1532fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
1533fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
1534fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
1535fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
1536fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
1537fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.18362.449.cat'; file='\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
1538fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1539fc8.25d4: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\opengl32.dll'
1540fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
1541fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
1542fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
1543fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
1544fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
1545fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
1546fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
1547fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
1548fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
1549fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
1550fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
1551fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
1552fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
1553fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'win32u.dll'.
1554fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\DXCore.dll)
1555fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\DXCore.dll
1556fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42200000 LB 0x00021000 C:\Windows\System32\win32u.dll [fFlags=0x0]
1557fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
1558fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42290000 LB 0x0009e000 C:\Windows\System32\msvcp_win.dll [fFlags=0x0]
1559fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
1560fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41e10000 LB 0x00196000 C:\Windows\System32\gdi32full.dll [fFlags=0x0]
1561fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
1562fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
1563fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'user32.dll'.
1564fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'win32u.dll'.
1565fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\gdi32full.dll)
1566fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\gdi32full.dll
1567fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc44280000 LB 0x00026000 C:\Windows\System32\GDI32.dll [fFlags=0x0]
1568fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
1569fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc43420000 LB 0x00195000 C:\Windows\System32\USER32.dll [fFlags=0x0]
1570fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [avoiding WinVerifyTrust]
1571fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc43e80000 LB 0x00335000 C:\Windows\System32\combase.dll [fFlags=0x0]
1572fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [avoiding WinVerifyTrust]
1573fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42330000 LB 0x0004a000 C:\Windows\System32\cfgmgr32.dll [fFlags=0x0]
1574fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll)
1575fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
1576fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3fe90000 LB 0x00020000 C:\Windows\SYSTEM32\dxcore.dll [fFlags=0x0]
1577fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DXCore.dll [avoiding WinVerifyTrust]
1578fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2c270000 LB 0x0002c000 C:\Windows\SYSTEM32\GLU32.dll [fFlags=0x0]
1579fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
1580fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc29c10000 LB 0x00156000 C:\Windows\SYSTEM32\OPENGL32.dll [fFlags=0x0]
1581fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\opengl32.dll
1582fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc425e0000 LB 0x000a9000 C:\Windows\System32\shcore.dll [fFlags=0x0]
1583fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1584fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'rpcrt4.dll'.
1585fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
1586fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\SHCore.dll)
1587fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\SHCore.dll
1588fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41230000 LB 0x00010000 C:\Windows\System32\UMPDC.dll [fFlags=0x0]
1589fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\umpdc.dll)
1590fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\umpdc.dll
1591fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41260000 LB 0x0004a000 C:\Windows\System32\powrprof.dll [fFlags=0x0]
1592fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
1593fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'umpdc.dll'.
1594fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\powrprof.dll)
1595fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\powrprof.dll
1596fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42920000 LB 0x00052000 C:\Windows\System32\shlwapi.dll [fFlags=0x0]
1597fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
1598fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'gdi32.dll'.
1599fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'user32.dll'.
1600fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\shlwapi.dll)
1601fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
1602fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41240000 LB 0x00011000 C:\Windows\System32\kernel.appcore.dll [fFlags=0x0]
1603fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
1604fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
1605fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll)
1606fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll
1607fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41630000 LB 0x00782000 C:\Windows\System32\windows.storage.dll [fFlags=0x0]
1608fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
1609fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
1610fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'rpcrt4.dll'.
1611fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'profapi.dll'.
1612fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\windows.storage.dll)
1613fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\windows.storage.dll
1614fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc436f0000 LB 0x006e7000 C:\Windows\System32\SHELL32.dll [fFlags=0x0]
1615fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll [avoiding WinVerifyTrust]
1616fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc43180000 LB 0x00157000 C:\Windows\System32\ole32.dll [fFlags=0x0]
1617fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
1618fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2ca70000 LB 0x0001b000 C:\Windows\SYSTEM32\MPR.dll [fFlags=0x0]
1619fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
1620fc8.25d4: supR3HardenedDllNotificationCallback: load 000000005bc00000 LB 0x00565000 C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
1621fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
1622fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc098b0000 LB 0x005f7000 C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
1623fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
1624fc8.25d4: supR3HardenedDllNotificationCallback: load 000000005b690000 LB 0x00561000 C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
1625fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
1626fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc43350000 LB 0x000c5000 C:\Windows\System32\OLEAUT32.dll [fFlags=0x0]
1627fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
1628fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc09eb0000 LB 0x02316000 C:\Program Files\Oracle\VirtualBox\UICommon.dll [fFlags=0x0]
1629fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
1630fc8.25d4: supR3HardenedDllNotificationCallback: load 000000005b590000 LB 0x00054000 C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
1631fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
1632fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3ee20000 LB 0x0002d000 C:\Windows\SYSTEM32\WINMMBASE.dll [fFlags=0x0]
1633fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
1634fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3efb0000 LB 0x00024000 C:\Windows\SYSTEM32\WINMM.dll [fFlags=0x0]
1635fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
1636fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc0d490000 LB 0x001c8000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll [fFlags=0x0]
1637fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
1638fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1639fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1640fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1641fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1642fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1643fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1644fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1645fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1646fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1647fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1648fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1649fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1650fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1651fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1652fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1653fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1654fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1655fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1656fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1657fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1658fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1659fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1660fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1661fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1662fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1663fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1664fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1665fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1666fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1667fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1668fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1669fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1670fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1671fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1672fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1673fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1674fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1675fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1676fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
1677fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
1678fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
1679fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll
1680fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1681fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1682fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
1683fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
1684fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
1685fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1686fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
1687fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
1688fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
1689fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [redoing WinVerifyTrust]
1690fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1691fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\combase.dll
1692fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1693fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1694fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1695fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1696fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1697fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1698fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
1699fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1700fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\user32.dll
1701fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1702fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1703fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
1704fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1705fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\gdi32.dll
1706fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1707fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1708fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'umpdc.dll'...
1709fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'umpdc.dll' -> '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rcNtRedir=0xc0150008]
1710fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\umpdc.dll [redoing WinVerifyTrust]
1711fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1712fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\umpdc.dll
1713fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1714fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1715fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
1716fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
1717fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll [redoing WinVerifyTrust]
1718fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1719fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\combase.dll
1720fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1721fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1722fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
1723fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1724fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1725fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
1726fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
1727fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
1728fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1729fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
1730fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1731fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1732fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
1733fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1734fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\user32.dll
1735fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1736fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1737fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
1738fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1739fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\gdi32.dll
1740fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
1741fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
1742fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
1743fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1744fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
1745fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
1746fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
1747fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
1748fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1749fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
1750fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
1751fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
1752fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
1753fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1754fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
1755fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1756fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\kernel32.dll'
1757fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1758fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1759fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1760fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1761fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1762fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1763fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1764fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1765fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1766fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1767fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1768fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1769fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1770fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1771fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1772fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1773fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1774fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1775fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1776fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1777fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1778fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1779fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1780fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1781fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1782fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1783fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1784fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1785fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1786fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1787fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1788fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1789fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1790fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1791fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1792fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1793fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1794fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1795fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1796fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1797fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1798fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1799fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1800fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1801fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1802fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1803fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1804fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1805fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1806fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1807fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1808fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1809fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1810fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1811fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1812fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1813fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1814fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1815fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1816fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1817fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1818fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1819fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1820fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1821fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1822fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1823fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1824fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1825fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1826fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1827fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1828fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1829fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1830fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1831fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1832fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1833fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
1834fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1835fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-string-l1-1-0'
1836fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1837fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1838fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1839fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1840fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1841fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1842fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1843fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1844fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1845fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1846fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1847fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1848fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1849fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1850fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1851fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1852fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1853fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1854fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1855fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1856fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1857fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1858fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1859fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1860fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1861fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1862fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1863fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1864fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1865fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1866fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1867fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1868fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1869fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1870fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1871fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1872fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1873fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1874fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1875fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1876fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1877fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1878fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1879fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1880fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1881fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1882fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1883fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1884fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1885fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1886fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1887fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1888fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1889fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1890fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1891fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1892fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1893fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1894fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1895fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1896fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1897fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1898fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1899fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1900fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1901fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1902fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1903fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1904fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1905fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1906fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1907fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1908fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1909fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1910fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1911fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1912fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
1913fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1914fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-datetime-l1-1-1'
1915fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1916fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1917fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1918fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1919fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1920fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1921fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1922fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1923fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1924fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1925fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1926fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1927fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1928fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1929fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1930fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1931fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1932fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1933fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1934fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1935fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1936fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1937fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1938fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1939fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1940fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1941fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1942fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1943fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1944fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1945fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1946fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1947fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1948fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1949fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1950fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1951fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1952fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1953fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1954fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1955fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1956fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1957fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1958fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
1959fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
1960fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
1961fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
1962fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
1963fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
1964fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
1965fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
1966fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
1967fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
1968fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
1969fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
1970fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
1971fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
1972fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
1973fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
1974fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
1975fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
1976fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
1977fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
1978fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
1979fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
1980fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
1981fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
1982fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
1983fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
1984fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
1985fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
1986fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
1987fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
1988fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
1989fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
1990fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
1991fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
1992fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1993fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-localization-obsolete-l1-2-0'
1994fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
1995fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
1996fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
1997fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
1998fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
1999fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
2000fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
2001fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
2002fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
2003fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
2004fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
2005fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
2006fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
2007fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
2008fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
2009fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
2010fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
2011fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
2012fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
2013fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
2014fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
2015fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
2016fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
2017fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
2018fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
2019fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
2020fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2021fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
2022fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
2023fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
2024fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2025fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
2026fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
2027fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
2028fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
2029fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
2030fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
2031fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
2032fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
2033fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
2034fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
2035fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
2036fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
2037fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
2038fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
2039fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
2040fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
2041fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
2042fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
2043fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
2044fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
2045fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
2046fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
2047fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
2048fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
2049fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
2050fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
2051fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
2052fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
2053fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
2054fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
2055fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
2056fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
2057fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
2058fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2059fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
2060fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
2061fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
2062fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2063fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
2064fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
2065fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
2066fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
2067fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
2068fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
2069fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
2070fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
2071fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
2072fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
2073fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\imm32.dll)
2074fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\imm32.dll
2075fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
2076fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
2077fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll [redoing WinVerifyTrust]
2078fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2079fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\win32u.dll
2080fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2081fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2082fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll [redoing WinVerifyTrust]
2083fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2084fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\user32.dll
2085fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
2086fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42a30000 LB 0x0002e000 C:\Windows\System32\IMM32.DLL [fFlags=0x0]
2087fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
2088fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42a30000 'C:\Windows\system32\IMM32.DLL'
2089fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
2090fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
2091fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
2092fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
2093fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
2094fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
2095fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
2096fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
2097fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
2098fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
2099fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
2100fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
2101fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
2102fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
2103fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
2104fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
2105fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
2106fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
2107fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
2108fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
2109fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
2110fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
2111fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
2112fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
2113fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
2114fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
2115fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
2116fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
2117fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2118fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
2119fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
2120fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
2121fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2122fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
2123fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
2124fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
2125fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
2126fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
2127fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
2128fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
2129fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
2130fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
2131fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
2132fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
2133fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
2134fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
2135fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
2136fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
2137fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
2138fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
2139fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
2140fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
2141fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
2142fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
2143fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
2144fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
2145fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
2146fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
2147fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
2148fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
2149fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
2150fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
2151fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
2152fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
2153fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
2154fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
2155fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
2156fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
2157fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2158fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
2159fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
2160fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
2161fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2162fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
2163fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
2164fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
2165fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
2166fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
2167fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
2168fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
2169fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
2170fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2171fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42760000 'C:\Windows\System32\ADVAPI32.DLL'
2172fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\imm32.dll'.
2173fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rescheduled]
2174fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'.
2175fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll' [rescheduled]
2176fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'.
2177fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll' [rescheduled]
2178fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'.
2179fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rescheduled]
2180fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'.
2181fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll' [rescheduled]
2182fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'.
2183fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rescheduled]
2184fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'.
2185fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll' [rescheduled]
2186fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'.
2187fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rescheduled]
2188fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'.
2189fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll' [rescheduled]
2190fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
2191fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
2192fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\glu32.dll'.
2193fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll' [rescheduled]
2194fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\mpr.dll'.
2195fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll' [rescheduled]
2196fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\shell32.dll'.
2197fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rescheduled]
2198fc8.25d4: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a) '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
2199fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
2200fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\win32u.dll'.
2201fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rescheduled]
2202fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'.
2203fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rescheduled]
2204fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\user32.dll'.
2205fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rescheduled]
2206fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'.
2207fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rescheduled]
2208fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\combase.dll'.
2209fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rescheduled]
2210fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'.
2211fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rescheduled]
2212fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc0d490000 'C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll'
2213fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2214fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2215fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\imm32.dll'
2216fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2217fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2218fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\windows.storage.dll'
2219fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2220fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2221fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\kernel.appcore.dll'
2222fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2223fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2224fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll'
2225fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2226fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2227fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\powrprof.dll'
2228fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2229fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2230fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\umpdc.dll'
2231fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2232fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2233fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\SHCore.dll'
2234fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2235fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2236fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll'
2237fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2238fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2239fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32full.dll'
2240fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2241fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2242fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'
2243fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000474 pwszName=\Device\HarddiskVolume3\Windows\System32\glu32.dll
2244fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2245fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2246fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F356C86D0A2DBA0570D09B39D4AF818DFCB17010
2247fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2248fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2249fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.18362.449.cat'; file='\Device\HarddiskVolume3\Windows\System32\glu32.dll'
2250fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
2251fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\glu32.dll'
2252fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2253fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2254fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\mpr.dll'
2255fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2256fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2257fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\shell32.dll'
2258fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2259fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'
2260fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2261fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2262fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\win32u.dll'
2263fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2264fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2265fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\gdi32.dll'
2266fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2267fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2268fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\user32.dll'
2269fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2270fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2271fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll'
2272fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2273fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2274fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\combase.dll'
2275fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
2276fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2277fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2278fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2279fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll'
2280fc8.25d4: SUPR3HardenedMain: Calling TrustedMain (00007ffc0d4916c0)...
2281fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2282fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
2283fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
2284fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
2285fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
2286fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
2287fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
2288fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
2289fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
2290fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
2291fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
2292fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
2293fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
2294fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
2295fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
2296fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
2297fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
2298fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
2299fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
2300fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
2301fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
2302fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
2303fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2304fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2305fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
2306fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
2307fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
2308fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
2309fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
2310fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
2311fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2312fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
2313fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
2314fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
2315fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
2316fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
2317fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
2318fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2319fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2320fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
2321fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
2322fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
2323fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2324fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2325fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2326fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
2327fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc20d00000 LB 0x0012e000 C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
2328fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
2329fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20d00000 'C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
2330fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000600 pwszName=\Device\HarddiskVolume3\Windows\System32\uxtheme.dll
2331fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2332fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2333fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=286AD1CEC16EFDCA5718925D19E68A486A5851A0
2334fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2335fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2336fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0415~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\uxtheme.dll'
2337fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
2338fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2339fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
2340fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
2341fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\uxtheme.dll) WinVerifyTrust
2342fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
2343fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2344fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2345fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2346fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2347fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2348fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2349fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
2350fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
2351fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f250000 LB 0x00099000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
2352fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
2353fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3f250000 'C:\Windows\system32\uxtheme.dll'
2354fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43420000 'C:\Windows\system32\user32.dll'
2355fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
2356fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2357fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
2358fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
2359fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2360fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc425e0000 'C:\Windows\system32\SHCore.dll'
2361fc8.25d4: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\Windows\system32\wintab32.dll': 0 (NtPath=\??\C:\Windows\system32\wintab32.dll; Input=C:\Windows\system32\wintab32.dll; rcNtGetDll=0x0
2362fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\Windows\system32\wintab32.dll'
2363fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
2364fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2365fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\system32\winmm.dll'
2366fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
2367fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2368fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\system32\winmm.dll'
2369fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
2370fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2371fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
2372fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
2373fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2374fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3f250000 'C:\Windows\system32\uxtheme.dll'
2375fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
2376fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\advapi32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2377fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42760000 'C:\Windows\system32\advapi32.dll'
2378fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2379fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2380fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'rpcrt4.dll'.
2381fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'profapi.dll'.
2382fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\userenv.dll) WinVerifyTrust
2383fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\userenv.dll
2384fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
2385fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
2386fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll
2387fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2388fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2389fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\userenv.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2390fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
2391fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41150000 LB 0x00025000 C:\Windows\system32\userenv.dll [fFlags=0x0]
2392fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
2393fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41150000 'C:\Windows\system32\userenv.dll'
2394fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
2395fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2396fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\kernel32.dll'
2397fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42980000 LB 0x000a2000 C:\Windows\System32\clbcatq.dll [fFlags=0x0]
2398fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2399fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
2400fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\clbcatq.dll)
2401fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\clbcatq.dll
2402fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2403fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2404fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2405fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2406fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2407fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2408fc8.938: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\clbcatq.dll'
2409fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2410fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
2411fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
2412fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
2413fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
2414fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
2415fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
2416fc8.938: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
2417fc8.938: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
2418fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
2419fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
2420fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2421fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
2422fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
2423fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
2424fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2425fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2426fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
2427fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
2428fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
2429fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
2430fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
2431fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
2432fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
2433fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
2434fc8.938: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
2435fc8.938: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
2436fc8.938: supR3HardenedDllNotificationCallback: load 00007ffc094f0000 LB 0x003be000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
2437fc8.938: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
2438fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc094f0000 'C:\Program Files\Oracle\VirtualBox\VBoxC.dll'
2439fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2440fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
2441fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
2442fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
2443fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
2444fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
2445fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
2446fc8.938: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
2447fc8.938: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
2448fc8.938: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
2449fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2450fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2451fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
2452fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
2453fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2454fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
2455fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
2456fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
2457fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
2458fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
2459fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
2460fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2461fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2462fc8.938: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
2463fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
2464fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
2465fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
2466fc8.938: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
2467fc8.938: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
2468fc8.938: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
2469fc8.938: supR3HardenedDllNotificationCallback: load 00007ffc23390000 LB 0x000ef000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
2470fc8.938: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
2471fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc23390000 'C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
2472fc8.938: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2473fc8.938: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
2474fc8.938: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43350000 'C:\Windows\System32\oleaut32.dll'
2475fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc44280000 'C:\Windows\system32\gdi32.dll'
2476fc8.1770: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2477fc8.1770: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2478fc8.1770: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2479fc8.1770: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
2480fc8.1770: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
2481fc8.1770: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll) WinVerifyTrust
2482fc8.1770: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
2483fc8.1770: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
2484fc8.1770: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
2485fc8.1770: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
2486fc8.1770: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
2487fc8.1770: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2488fc8.1770: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
2489fc8.1770: supR3HardenedDllNotificationCallback: load 00007ffc341c0000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [fFlags=0x0]
2490fc8.1770: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
2491fc8.1770: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc341c0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL'
2492fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
2493fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2494fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
2495fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc42b10000 LB 0x00135000 C:\Windows\System32\MSCTF.dll [fFlags=0x0]
2496fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2497fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'oleaut32.dll'.
2498fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'user32.dll'.
2499fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'gdi32.dll'.
2500fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'imm32.dll'.
2501fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'advapi32.dll'.
2502fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msctf.dll)
2503fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msctf.dll
2504fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2505fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2506fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
2507fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
2508fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
2509fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2510fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2511fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2512fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2513fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\user32.dll
2514fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
2515fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
2516fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2517fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2518fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2519fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2520fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2521fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msctf.dll'
2522fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000082c pwszName=\Device\HarddiskVolume3\Windows\System32\DataExchange.dll
2523fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2524fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2525fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AF758F581E6ED4B195B000E1E88DA05815FF2C72
2526fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2527fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2528fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0410~31bf3856ad364e35~amd64~~10.0.18362.959.cat'; file='\Device\HarddiskVolume3\Windows\System32\DataExchange.dll'
2529fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
2530fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2531fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'shcore.dll'.
2532fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'combase.dll'.
2533fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'd3d11.dll'.
2534fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'dcomp.dll'.
2535fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\DataExchange.dll) WinVerifyTrust
2536fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
2537fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
2538fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' -> '\Device\HarddiskVolume3\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
2539fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2540fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2541fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
2542fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp_win.dll'.
2543fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dcomp.dll) WinVerifyTrust
2544fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dcomp.dll
2545fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
2546fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume3\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
2547fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
2548fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
2549fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
2550fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
2551fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
2552fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll
2553fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2554fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2555fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2556fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'dxgi.dll'.
2557fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'win32u.dll'.
2558fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\d3d11.dll) WinVerifyTrust
2559fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\d3d11.dll
2560fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
2561fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
2562fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
2563fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
2564fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
2565fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
2566fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2567fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2568fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
2569fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
2570fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\win32u.dll
2571fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
2572fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume3\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
2573fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2574fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2575fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2576fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'win32u.dll'.
2577fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dxgi.dll) WinVerifyTrust
2578fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dxgi.dll
2579fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2580fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2581fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
2582fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
2583fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume3\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
2584fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2585fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2586fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
2587fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
2588fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
2589fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
2590fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll
2591fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3fff0000 LB 0x000eb000 C:\Windows\system32\dxgi.dll [fFlags=0x0]
2592fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dxgi.dll
2593fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3e120000 LB 0x0025b000 C:\Windows\system32\d3d11.dll [fFlags=0x0]
2594fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\d3d11.dll
2595fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3e7e0000 LB 0x001dd000 C:\Windows\system32\dcomp.dll [fFlags=0x0]
2596fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dcomp.dll
2597fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc25da0000 LB 0x0003a000 C:\Windows\system32\dataexchange.dll [fFlags=0x0]
2598fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\DataExchange.dll
2599fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc44280000 'C:\Windows\System32\gdi32.dll'
2600fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc25da0000 'C:\Windows\system32\dataexchange.dll'
2601fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rmclient.dll'.
2602fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
2603fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'combase.dll'.
2604fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'msvcp_win.dll'.
2605fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll)
2606fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll
2607fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2608fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
2609fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\rmclient.dll)
2610fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\rmclient.dll
2611fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f840000 LB 0x00029000 C:\Windows\system32\RMCLIENT.dll [fFlags=0x0]
2612fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rmclient.dll [avoiding WinVerifyTrust]
2613fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f320000 LB 0x00262000 C:\Windows\system32\twinapi.appcore.dll [fFlags=0x0]
2614fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
2615fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2616fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2617fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2618fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2619fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
2620fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
2621fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
2622fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
2623fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
2624fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
2625fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2626fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2627fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rmclient.dll'...
2628fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rmclient.dll' -> '\Device\HarddiskVolume3\Windows\System32\rmclient.dll' [rcNtRedir=0xc0150008]
2629fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rmclient.dll [lacks WinVerifyTrust]
2630fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2631fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2632fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\rmclient.dll'
2633fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2634fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\crypt32.dll
2635fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2636fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2637fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\twinapi.appcore.dll'
2638fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
2639fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shcore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2640fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc425e0000 'C:\Windows\system32\Shcore.dll'
2641fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2642fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'rpcrt4.dll'.
2643fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'coreuicomponents.dll'.
2644fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'coremessaging.dll'.
2645fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll)
2646fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll
2647fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2648fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'coremessaging.dll'.
2649fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'shcore.dll'.
2650fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll)
2651fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll
2652fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2653fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll)
2654fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll
2655fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntmarta.dll)
2656fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntmarta.dll
2657fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
2658fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
2659fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'bcryptprimitives.dll'.
2660fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\WinTypes.dll)
2661fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\WinTypes.dll
2662fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc40280000 LB 0x00031000 C:\Windows\SYSTEM32\ntmarta.dll [fFlags=0x0]
2663fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
2664fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3e9d0000 LB 0x000d4000 C:\Windows\System32\CoreMessaging.dll [fFlags=0x0]
2665fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [avoiding WinVerifyTrust]
2666fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3c990000 LB 0x00153000 C:\Windows\SYSTEM32\wintypes.dll [fFlags=0x0]
2667fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
2668fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3cb30000 LB 0x0032a000 C:\Windows\System32\CoreUIComponents.dll [fFlags=0x0]
2669fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [avoiding WinVerifyTrust]
2670fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2a780000 LB 0x0009e000 C:\Windows\System32\TextInputFramework.dll [fFlags=0x0]
2671fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll [avoiding WinVerifyTrust]
2672fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
2673fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
2674fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcryptprimitives.dll
2675fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2676fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2677fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
2678fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume3\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
2679fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\combase.dll
2680fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2681fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2682fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
2683fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
2684fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
2685fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
2686fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
2687fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
2688fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2689fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2690fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
2691fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume3\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
2692fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
2693fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coreuicomponents.dll'...
2694fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' -> '\Device\HarddiskVolume3\Windows\System32\coreuicomponents.dll' [rcNtRedir=0xc0150008]
2695fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll [lacks WinVerifyTrust]
2696fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2697fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2698fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2699fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2700fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2701fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2702fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\WinTypes.dll'
2703fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2704fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2705fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ntmarta.dll'
2706fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2707fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2708fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreMessaging.dll'
2709fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2710fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2711fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\CoreUIComponents.dll'
2712fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2713fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2714fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\TextInputFramework.dll'
2715fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll) -> 0x0, fPresent=1
2716fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2717fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43420000 'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll'
2718fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll) -> 0x0, fPresent=1
2719fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2720fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43420000 'ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll'
2721fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-com-l1-1-0.dll) -> 0x0, fPresent=1
2722fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-com-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2723fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43e80000 'api-ms-win-core-com-l1-1-0.dll'
2724fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2725fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\iertutil.dll)
2726fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\iertutil.dll
2727fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc37040000 LB 0x002a6000 C:\Windows\System32\iertutil.dll [fFlags=0x0]
2728fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\iertutil.dll [avoiding WinVerifyTrust]
2729fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2730fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2731fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2732fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2733fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\iertutil.dll'
2734fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
2735fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
2736fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43180000 'C:\Windows\system32\ole32.dll'
2737fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2738fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2739fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2740fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
2741fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
2742fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
2743fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
2744fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
2745fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'comctl32.dll'.
2746fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'version.dll'.
2747fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'dui70.dll'.
2748fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'propsys.dll'.
2749fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shcore.dll'.
2750fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCTIP.dll) WinVerifyTrust
2751fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCTIP.dll
2752fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
2753fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
2754fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\SHCore.dll
2755fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
2756fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume3\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
2757fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2758fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2759fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'oleaut32.dll'.
2760fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'rpcrt4.dll'.
2761fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\propsys.dll) WinVerifyTrust
2762fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\propsys.dll
2763fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dui70.dll'...
2764fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'dui70.dll' -> '\Device\HarddiskVolume3\Windows\System32\dui70.dll' [rcNtRedir=0xc0150008]
2765fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ad8 pwszName=\Device\HarddiskVolume3\Windows\System32\dui70.dll
2766fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2767fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2768fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=68BCE645C27EBE8A15C81A1E5D34DF4EA5BF087D
2769fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2770fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2771fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
2772fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
2773fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
2774fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2775fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2776fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\dui70.dll'
2777fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
2778fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2779fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'user32.dll'.
2780fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
2781fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dui70.dll) WinVerifyTrust
2782fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dui70.dll
2783fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
2784fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume3\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
2785fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2786fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2787fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\gdi32.dll
2788fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2789fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2790fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2791fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2792fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2793fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2794fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2795fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\version.dll) WinVerifyTrust
2796fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\version.dll
2797fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
2798fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume3\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
2799fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2800fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2801fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2802fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2803fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
2804fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
2805fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
2806fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\comctl32.dll) WinVerifyTrust
2807fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\comctl32.dll
2808fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
2809fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
2810fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
2811fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2812fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2813fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2814fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2815fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
2816fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
2817fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2818fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2819fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2820fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2821fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2822fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2823fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2824fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2825fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2826fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2827fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IME\IMETC\IMTCTIP.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
2828fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCTIP.dll
2829fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
2830fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
2831fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
2832fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll)
2833fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll
2834fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
2835fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dui70.dll
2836fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\propsys.dll
2837fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp110_win.dll'.
2838fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
2839fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
2840fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\policymanager.dll)
2841fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\policymanager.dll
2842fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2843fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll)
2844fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll
2845fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc23480000 LB 0x000a9000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\COMCTL32.dll [fFlags=0x0]
2846fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll [avoiding WinVerifyTrust]
2847fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3b7c0000 LB 0x0000a000 C:\Windows\SYSTEM32\VERSION.dll [fFlags=0x0]
2848fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
2849fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc21110000 LB 0x001b3000 C:\Windows\SYSTEM32\DUI70.dll [fFlags=0x0]
2850fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dui70.dll
2851fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3d750000 LB 0x000f0000 C:\Windows\SYSTEM32\PROPSYS.dll [fFlags=0x0]
2852fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\propsys.dll
2853fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3da00000 LB 0x0008a000 C:\Windows\SYSTEM32\msvcp110_win.dll [fFlags=0x0]
2854fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll [avoiding WinVerifyTrust]
2855fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3b5f0000 LB 0x00086000 C:\Windows\SYSTEM32\policymanager.dll [fFlags=0x0]
2856fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\policymanager.dll [avoiding WinVerifyTrust]
2857fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc30960000 LB 0x0014a000 C:\Windows\system32\IME\IMETC\IMTCTIP.DLL [fFlags=0x0]
2858fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCTIP.dll
2859fc8.25d4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume3\Windows\System32\apphelp.dll)
2860fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\apphelp.dll
2861fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f100000 LB 0x0008f000 C:\Windows\SYSTEM32\apphelp.dll [fFlags=0x0]
2862fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume3\Windows\System32\apphelp.dll [avoiding WinVerifyTrust]
2863fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2864fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2865fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2866fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2867fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2868fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2869fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2870fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2871fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2872fc8.25d4: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
2873fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntdll.dll)
2874fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntdll.dll
2875fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2876fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2877fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
2878fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
2879fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
2880fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
2881fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp110_win.dll'...
2882fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp110_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rcNtRedir=0xc0150008]
2883fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll [redoing WinVerifyTrust]
2884fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2885fc8.25d4: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll
2886fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
2887fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
2888fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
2889fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
2890fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
2891fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
2892fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
2893fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc44380000 'C:\Windows\System32\ntdll.dll'
2894fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2895fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' [rescheduled]
2896fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2897fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2898fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2899fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2900fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2901fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2902fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2903fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2904fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2905fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' [rescheduled]
2906fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2907fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2908fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2909fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2910fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2911fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2912fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2913fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2914fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\imm32.dll
2915fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2916fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42a30000 'C:\Windows\System32\imm32.dll'
2917fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2918fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' [rescheduled]
2919fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2920fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2921fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2922fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2923fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2924fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2925fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2926fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2927fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2928fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' [rescheduled]
2929fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2930fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2931fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2932fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2933fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2934fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2935fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2936fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2937fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43180000 'C:\Windows\System32\ole32.dll'
2938fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
2939fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' [rescheduled]
2940fc8.25d4: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'.
2941fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll' [rescheduled]
2942fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'.
2943fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll' [rescheduled]
2944fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'.
2945fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll' [rescheduled]
2946fc8.25d4: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'.
2947fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll' [rescheduled]
2948fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc30960000 'C:\Windows\system32\IME\IMETC\IMTCTIP.DLL'
2949fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2950fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2951fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'
2952fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ad0 pwszName=\Device\HarddiskVolume3\Windows\System32\apphelp.dll
2953fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2954fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2955fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CAB05C7236BF75A3E9746E25E1039005E1268927
2956fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2957fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2958fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0414~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\apphelp.dll'
2959fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
2960fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\apphelp.dll'
2961fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2962fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2963fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll'
2964fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2965fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2966fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\policymanager.dll'
2967fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2968fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2969fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\comctl32.dll'
2970fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
2971fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.DLL (Input=MSCTF.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
2972fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\System32\MSCTF.DLL'
2973fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2974fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
2975fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
2976fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
2977fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
2978fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
2979fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
2980fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
2981fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'oleacc.dll'.
2982fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'version.dll'.
2983fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'dui70.dll'.
2984fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMETIP.DLL) WinVerifyTrust
2985fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMETIP.DLL
2986fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dui70.dll'...
2987fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'dui70.dll' -> '\Device\HarddiskVolume3\Windows\System32\dui70.dll' [rcNtRedir=0xc0150008]
2988fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dui70.dll
2989fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
2990fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume3\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
2991fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
2992fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleacc.dll'...
2993fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleacc.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleacc.dll' [rcNtRedir=0xc0150008]
2994fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000af0 pwszName=\Device\HarddiskVolume3\Windows\System32\oleacc.dll
2995fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
2996fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
2997fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4DE24409C9F6743A292F9B0C8FB1A7F688A78696
2998fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
2999fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3000fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04113~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\oleacc.dll'
3001fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3002fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
3003fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'user32.dll'.
3004fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\oleacc.dll) WinVerifyTrust
3005fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\oleacc.dll
3006fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
3007fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
3008fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3009fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3010fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3011fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3012fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3013fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3014fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
3015fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
3016fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3017fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3018fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3019fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3020fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3021fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3022fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\IME\shared\imetip.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3023fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMETIP.DLL
3024fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleacc.dll
3025fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc25de0000 LB 0x00065000 C:\Windows\SYSTEM32\OLEACC.dll [fFlags=0x0]
3026fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleacc.dll
3027fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc305a0000 LB 0x00139000 C:\Windows\System32\IME\shared\imetip.dll [fFlags=0x0]
3028fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMETIP.DLL
3029fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc305a0000 'C:\Windows\System32\IME\shared\imetip.dll'
3030fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
3031fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.DLL (Input=MSCTF.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3032fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\System32\MSCTF.DLL'
3033fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
3034fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3035fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\System32\msctf.dll'
3036fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
3037fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3038fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\system32\msctf.dll'
3039fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3040fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3041fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3042fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'oleaut32.dll'.
3043fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCFG.DLL) WinVerifyTrust
3044fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCFG.DLL
3045fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3046fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3047fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3048fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3049fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IME\IMETC\IMTCCFG.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3050fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCFG.DLL
3051fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc32fe0000 LB 0x0004d000 C:\Windows\system32\IME\IMETC\IMTCCFG.DLL [fFlags=0x0]
3052fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCFG.DLL
3053fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc32fe0000 'C:\Windows\system32\IME\IMETC\IMTCCFG.DLL'
3054fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3055fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3056fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3057fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'oleaut32.dll'.
3058fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'crypt32.dll'.
3059fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'ncrypt.dll'.
3060fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #44 'profapi.dll'.
3061fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCORE.DLL) WinVerifyTrust
3062fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCORE.DLL
3063fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
3064fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
3065fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\profapi.dll
3066fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ncrypt.dll'...
3067fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ncrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\ncrypt.dll' [rcNtRedir=0xc0150008]
3068fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3069fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3070fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcrypt.dll'.
3071fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'ntasn1.dll'.
3072fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ncrypt.dll) WinVerifyTrust
3073fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ncrypt.dll
3074fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
3075fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume3\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
3076fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3077fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3078fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3079fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3080fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ntasn1.dll'...
3081fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ntasn1.dll' -> '\Device\HarddiskVolume3\Windows\System32\ntasn1.dll' [rcNtRedir=0xc0150008]
3082fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3083fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3084fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntasn1.dll) WinVerifyTrust
3085fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntasn1.dll
3086fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
3087fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
3088fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
3089fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IME\IMETC\IMTCCORE.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3090fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCORE.DLL
3091fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ncrypt.dll
3092fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntasn1.dll
3093fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc40cc0000 LB 0x0003b000 C:\Windows\SYSTEM32\NTASN1.dll [fFlags=0x0]
3094fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntasn1.dll
3095fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc40d00000 LB 0x00026000 C:\Windows\SYSTEM32\ncrypt.dll [fFlags=0x0]
3096fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ncrypt.dll
3097fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc20ff0000 LB 0x00118000 C:\Windows\system32\IME\IMETC\IMTCCORE.DLL [fFlags=0x0]
3098fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\IMETC\IMTCCORE.DLL
3099fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43180000 'C:\Windows\System32\ole32.dll'
3100fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20ff0000 'C:\Windows\system32\IME\IMETC\IMTCCORE.DLL'
3101fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3102fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3103fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3104fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
3105fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
3106fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
3107fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
3108fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
3109fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'wer.dll'.
3110fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\SHARED\imecfm.dll) WinVerifyTrust
3111fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\SHARED\imecfm.dll
3112fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wer.dll'...
3113fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'wer.dll' -> '\Device\HarddiskVolume3\Windows\System32\wer.dll' [rcNtRedir=0xc0150008]
3114fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3115fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3116fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3117fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'rpcrt4.dll'.
3118fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #61 'umpdc.dll'.
3119fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wer.dll) WinVerifyTrust
3120fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wer.dll
3121fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3122fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3123fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3124fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3125fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
3126fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
3127fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
3128fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3129fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3130fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
3131fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
3132fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3133fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3134fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'umpdc.dll'...
3135fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'umpdc.dll' -> '\Device\HarddiskVolume3\Windows\System32\umpdc.dll' [rcNtRedir=0xc0150008]
3136fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\umpdc.dll
3137fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3138fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3139fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3140fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3141fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcrt.dll
3142fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\IME\shared\imecfm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3143fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\imecfm.dll
3144fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wer.dll
3145fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f760000 LB 0x000dc000 C:\Windows\SYSTEM32\wer.dll [fFlags=0x0]
3146fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wer.dll
3147fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc32fa0000 LB 0x00038000 C:\Windows\System32\IME\shared\imecfm.dll [fFlags=0x0]
3148fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\imecfm.dll
3149fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc32fa0000 'C:\Windows\System32\IME\shared\imecfm.dll'
3150fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\uxtheme.dll
3151fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\UXTHEME.DLL (Input=UXTHEME.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3152fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3f250000 'C:\Windows\System32\UXTHEME.DLL'
3153fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\imecfm.dll
3154fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\IME\shared\imecfm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3155fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc32fa0000 'C:\Windows\System32\IME\shared\imecfm.dll'
3156fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3157fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3158fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3159fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'oleaut32.dll'.
3160fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
3161fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
3162fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
3163fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ole32.dll'.
3164fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msimg32.dll'.
3165fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
3166fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'duser.dll'.
3167fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'dui70.dll'.
3168fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
3169fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'uiautomationcore.dll'.
3170fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\SHARED\MSCAND20.DLL) WinVerifyTrust
3171fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\SHARED\MSCAND20.DLL
3172fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uiautomationcore.dll'...
3173fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'uiautomationcore.dll' -> '\Device\HarddiskVolume3\Windows\System32\uiautomationcore.dll' [rcNtRedir=0xc0150008]
3174fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b9c pwszName=\Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll
3175fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3176fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3177fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F52AB6DC0BD71E702759576A7EF33ACC2C37CA88
3178fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3179fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3180fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0410~31bf3856ad364e35~amd64~~10.0.18362.997.cat'; file='\Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll'
3181fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3182fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
3183fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
3184fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'rpcrt4.dll'.
3185fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll) WinVerifyTrust
3186fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll
3187fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
3188fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume3\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
3189fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dui70.dll'...
3190fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'dui70.dll' -> '\Device\HarddiskVolume3\Windows\System32\dui70.dll' [rcNtRedir=0xc0150008]
3191fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dui70.dll
3192fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'duser.dll'...
3193fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'duser.dll' -> '\Device\HarddiskVolume3\Windows\System32\duser.dll' [rcNtRedir=0xc0150008]
3194fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b5c pwszName=\Device\HarddiskVolume3\Windows\System32\duser.dll
3195fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3196fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3197fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09BC45C4D5E42401D74972740E9053BB12859727
3198fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3199fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3200fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3201fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3202fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
3203fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
3204fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
3205fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3206fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3207fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\duser.dll'
3208fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3209fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3210fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'user32.dll'.
3211fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'gdi32.dll'.
3212fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\duser.dll) WinVerifyTrust
3213fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\duser.dll
3214fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
3215fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
3216fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shlwapi.dll
3217fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msimg32.dll'...
3218fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msimg32.dll' -> '\Device\HarddiskVolume3\Windows\System32\msimg32.dll' [rcNtRedir=0xc0150008]
3219fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b98 pwszName=\Device\HarddiskVolume3\Windows\System32\msimg32.dll
3220fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3221fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3222fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0453EE11F89D618A82B43DBACFECDD530072D390
3223fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
3224fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
3225fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3226fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3227fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3228fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3229fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3230fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3231fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0417~31bf3856ad364e35~amd64~~10.0.18362.959.cat'; file='\Device\HarddiskVolume3\Windows\System32\msimg32.dll'
3232fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3233fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
3234fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msimg32.dll) WinVerifyTrust
3235fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msimg32.dll
3236fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3237fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3238fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
3239fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
3240fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
3241fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
3242fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3243fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3244fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3245fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3246fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3247fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3248fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
3249fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
3250fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\IME\shared\mscand20.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3251fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\MSCAND20.DLL
3252fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msimg32.dll
3253fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\duser.dll
3254fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll
3255fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc33320000 LB 0x00007000 C:\Windows\SYSTEM32\MSIMG32.dll [fFlags=0x0]
3256fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msimg32.dll
3257fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc31aa0000 LB 0x00093000 C:\Windows\SYSTEM32\DUser.dll [fFlags=0x0]
3258fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\duser.dll
3259fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc20030000 LB 0x00270000 C:\Windows\SYSTEM32\UIAutomationCore.DLL [fFlags=0x0]
3260fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\UIAutomationCore.dll
3261fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc20e30000 LB 0x001b7000 C:\Windows\System32\IME\shared\mscand20.dll [fFlags=0x0]
3262fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\MSCAND20.DLL
3263fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ntdll.dll
3264fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3265fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc44380000 'C:\Windows\System32\ntdll.dll'
3266fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43420000 'C:\Windows\System32\user32.dll'
3267fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20e30000 'C:\Windows\System32\IME\shared\mscand20.dll'
3268fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
3269fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
3270fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.DLL (Input=MSCTF.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3271fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\System32\MSCTF.DLL'
3272fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\iertutil.dll
3273fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\iertutil.dll (Input=iertutil.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3274fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc37040000 'C:\Windows\System32\iertutil.dll'
3275fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43420000 'C:\Windows\System32\user32.dll'
3276fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43350000 'C:\Windows\System32\OLEAUT32.DLL'
3277fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msctf.dll
3278fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
3279fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42b10000 'C:\Windows\System32\MSCTF.dll'
3280fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
3281fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
3282fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43180000 'C:\Windows\System32\ole32.dll'
3283fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\oleaut32.dll
3284fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\OLEAUT32.dll (Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3285fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc43350000 'C:\Windows\System32\OLEAUT32.dll'
3286fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b84 pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
3287fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3288fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3289fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DB1AA7E2E4704C908EC9382E1F9E64808B9E5E1D
3290fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3291fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3292fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll'
3293fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3294fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3295fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
3296fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
3297fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
3298fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
3299fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
3300fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
3301fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b80 pwszName=\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
3302fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3303fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3304fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=22EAF38FA276D7A374D3945ACD556FA0953D3440
3305fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3306fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3307fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll'
3308fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3309fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3310fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'bcrypt.dll'.
3311fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'ws2_32.dll'.
3312fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll) WinVerifyTrust
3313fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
3314fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
3315fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
3316fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
3317fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3318fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3319fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
3320fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
3321fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
3322fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
3323fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
3324fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
3325fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3326fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3327fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3328fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
3329fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
3330fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc310e0000 LB 0x00084000 C:\Windows\SYSTEM32\wbemcomn.dll [fFlags=0x0]
3331fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
3332fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc30d70000 LB 0x00011000 C:\Windows\system32\wbem\wbemprox.dll [fFlags=0x0]
3333fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemprox.dll
3334fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
3335fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
3336fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
3337fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc30d70000 'C:\Windows\system32\wbem\wbemprox.dll'
3338fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000bd4 pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
3339fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3340fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3341fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=00C864D7F76A7AD25E7D0DA164B0B66188F5B7FF
3342fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3343fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3344fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll'
3345fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3346fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3347fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
3348fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
3349fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
3350fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3351fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3352fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3353fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3354fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3355fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
3356fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2fb10000 LB 0x00014000 C:\Windows\system32\wbem\wbemsvc.dll [fFlags=0x0]
3357fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\wbemsvc.dll
3358fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc2fb10000 'C:\Windows\system32\wbem\wbemsvc.dll'
3359fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
3360fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
3361fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-localization-l1-2-0.dll'
3362fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
3363fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
3364fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
3365fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c5c pwszName=\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
3366fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3367fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3368fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0708A64F48237CD4D5092546CE9C373F20B30CA1
3369fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3370fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3371fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll'
3372fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3373fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3374fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'wbemcomn.dll'.
3375fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
3376fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
3377fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
3378fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume3\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
3379fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbemcomn.dll
3380fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3381fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3382fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3383fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
3384fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2fd80000 LB 0x00101000 C:\Windows\system32\wbem\fastprox.dll [fFlags=0x0]
3385fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wbem\fastprox.dll
3386fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc2fd80000 'C:\Windows\system32\wbem\fastprox.dll'
3387fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c1c pwszName=\Device\HarddiskVolume3\Windows\System32\amsi.dll
3388fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3389fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3390fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B5D4D58A583ACAD5AA76D7DD0F2DB8ADE903942B
3391fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3392fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3393fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\amsi.dll'
3394fc8.25d4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3395fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3396fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
3397fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'userenv.dll'.
3398fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\amsi.dll) WinVerifyTrust
3399fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\amsi.dll
3400fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'userenv.dll'...
3401fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' -> '\Device\HarddiskVolume3\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
3402fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\userenv.dll
3403fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3404fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3405fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3406fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3407fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\amsi.dll (Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3408fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\amsi.dll
3409fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2f550000 LB 0x00015000 C:\Windows\System32\amsi.dll [fFlags=0x0]
3410fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\amsi.dll
3411fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc2f550000 'C:\Windows\System32\amsi.dll'
3412fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3413fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3414fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'advapi32.dll'.
3415fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'ole32.dll'.
3416fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
3417fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.6-0\MpOAV.dll) WinVerifyTrust
3418fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.6-0\MpOAV.dll
3419fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3420fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3421fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3422fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3423fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ole32.dll
3424fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
3425fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
3426fc8.25d4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\advapi32.dll
3427fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2007.6-0\MpOav.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3428fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.6-0\MpOAV.dll
3429fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc2eaf0000 LB 0x0007a000 C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2007.6-0\MpOav.dll [fFlags=0x0]
3430fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.6-0\MpOAV.dll
3431fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
3432fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3433fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-synch-l1-2-0'
3434fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
3435fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3436fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-fibers-l1-1-1'
3437fc8.25d4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
3438fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3439fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41300000 'api-ms-win-core-localization-l1-2-1'
3440fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\kernel32.dll
3441fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3442fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42c50000 'C:\Windows\System32\kernel32.dll'
3443fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\version.dll
3444fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\version.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
3445fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3b7c0000 'C:\Windows\system32\version.dll'
3446fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc2eaf0000 'C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2007.6-0\MpOav.dll'
3447fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42760000 'C:\Windows\System32\ADVAPI32.dll'
3448fc8.2788: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3449fc8.2788: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3450fc8.2788: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3451fc8.2788: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
3452fc8.2788: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3453fc8.2788: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3454fc8.2788: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3455fc8.2788: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3456fc8.2788: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3457fc8.2788: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3458fc8.2788: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3459fc8.2788: supR3HardenedDllNotificationCallback: load 00007ffc08340000 LB 0x0037d000 C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
3460fc8.2788: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3461fc8.2788: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc08340000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
3462fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3463fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ddc pwszName=\Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll
3464fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3465fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3466fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7F5B666FF2CFCD1394E450AF7141F0F82A5730F3
3467fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3468fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3469fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04113~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll'
3470fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3471fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
3472fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
3473fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'oleaut32.dll'.
3474fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'ws2_32.dll'.
3475fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'netsetupapi.dll'.
3476fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'setupapi.dll'.
3477fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'devrtl.dll'.
3478fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll) WinVerifyTrust
3479fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll
3480fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devrtl.dll'...
3481fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'devrtl.dll' -> '\Device\HarddiskVolume3\Windows\System32\devrtl.dll' [rcNtRedir=0xc0150008]
3482fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000de0 pwszName=\Device\HarddiskVolume3\Windows\System32\devrtl.dll
3483fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3484fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3485fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D2E5A6C3AFA14B1D9C532760FD646C3AC357C7AB
3486fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3487fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3488fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0416~31bf3856ad364e35~amd64~~10.0.18362.997.cat'; file='\Device\HarddiskVolume3\Windows\System32\devrtl.dll'
3489fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3490fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\devrtl.dll) WinVerifyTrust
3491fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\devrtl.dll
3492fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
3493fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
3494fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3495fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3496fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3497fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
3498fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'cfgmgr32.dll'.
3499fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'bcrypt.dll'.
3500fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\setupapi.dll) WinVerifyTrust
3501fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\setupapi.dll
3502fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netsetupapi.dll'...
3503fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'netsetupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\netsetupapi.dll' [rcNtRedir=0xc0150008]
3504fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
3505fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume3\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
3506fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\bcrypt.dll
3507fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
3508fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
3509fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
3510fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3511fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3512fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3513fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3514fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3515fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3516fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3517fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
3518fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\NetSetupApi.dll) WinVerifyTrust
3519fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\NetSetupApi.dll
3520fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
3521fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
3522fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
3523fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3524fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3525fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3526fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3527fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll
3528fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
3529fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
3530fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msvcp_win.dll
3531fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3532fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3533fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3534fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3535fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupShim.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3536fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll
3537fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupApi.dll
3538fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devrtl.dll
3539fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc33660000 LB 0x00025000 C:\Windows\System32\NetSetupApi.dll [fFlags=0x0]
3540fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupApi.dll
3541fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc42d10000 LB 0x00470000 C:\Windows\System32\setupapi.dll [fFlags=0x0]
3542fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
3543fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc33690000 LB 0x00013000 C:\Windows\System32\DEVRTL.dll [fFlags=0x0]
3544fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devrtl.dll
3545fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc336c0000 LB 0x00081000 C:\Windows\System32\NetSetupShim.dll [fFlags=0x0]
3546fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupShim.dll
3547fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc336c0000 'C:\Windows\System32\NetSetupShim.dll'
3548fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3549fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3550fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3551fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
3552fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'nsi.dll'.
3553fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'winnsi.dll'.
3554fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\NetSetupEngine.dll) WinVerifyTrust
3555fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\NetSetupEngine.dll
3556fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winnsi.dll'...
3557fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'winnsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\winnsi.dll' [rcNtRedir=0xc0150008]
3558fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3559fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3560fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
3561fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
3562fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\winnsi.dll) WinVerifyTrust
3563fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\winnsi.dll
3564fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
3565fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
3566fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
3567fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume3\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
3568fc8.1124: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\nsi.dll'.
3569fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\nsi.dll)
3570fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\nsi.dll
3571fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3572fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3573fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3574fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3575fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\nsi.dll) WinVerifyTrust
3576fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3577fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3578fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3579fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3580fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupEngine.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3581fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupEngine.dll
3582fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winnsi.dll
3583fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc42b00000 LB 0x00008000 C:\Windows\System32\NSI.dll [fFlags=0x0]
3584fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\nsi.dll [avoiding WinVerifyTrust]
3585fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc3afe0000 LB 0x0000b000 C:\Windows\SYSTEM32\WINNSI.DLL [fFlags=0x0]
3586fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winnsi.dll
3587fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc191e0000 LB 0x000ce000 C:\Windows\System32\NetSetupEngine.dll [fFlags=0x0]
3588fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\NetSetupEngine.dll
3589fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc191e0000 'C:\Windows\System32\NetSetupEngine.dll'
3590fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3591fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3592fc8.1124: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\nsi.dll'
3593fc8.242c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3594fc8.242c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3595fc8.242c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
3596fc8.242c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
3597fc8.242c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
3598fc8.242c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
3599fc8.242c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
3600fc8.242c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
3601fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3602fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3603fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3604fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3605fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
3606fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
3607fc8.242c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3608fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
3609fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
3610fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3611fc8.242c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3612fc8.242c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3613fc8.242c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
3614fc8.242c: supR3HardenedDllNotificationCallback: load 00007ffc34180000 LB 0x0000f000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
3615fc8.242c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
3616fc8.242c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc34180000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
3617fc8.28bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3618fc8.28bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3619fc8.28bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
3620fc8.28bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
3621fc8.28bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
3622fc8.28bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
3623fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3624fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3625fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
3626fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
3627fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3628fc8.28bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3629fc8.28bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
3630fc8.28bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3631fc8.28bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
3632fc8.28bc: supR3HardenedDllNotificationCallback: load 00007ffc34170000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
3633fc8.28bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
3634fc8.28bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc34170000 'C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
3635fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\Shell32.dll'
3636fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3637fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3638fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc08340000 'C:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
3639fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3640fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3641fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3642fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
3643fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
3644fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
3645fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll) WinVerifyTrust
3646fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3647fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3648fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3649fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3650fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3651fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3652fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3653fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3654fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3655fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3656fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3657fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3658fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3659fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc222c0000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
3660fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3661fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc222c0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
3662fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc222c0000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
3663fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rsaenh.dll
3664fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3665fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3666fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3667fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3668fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
3669fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
3670fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
3671fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
3672fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
3673fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
3674fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
3675fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
3676fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
3677fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
3678fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
3679fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
3680fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
3681fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3682fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3683fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
3684fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
3685fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
3686fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
3687fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
3688fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume3\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
3689fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ws2_32.dll
3690fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
3691fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
3692fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
3693fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3694fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3695fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
3696fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
3697fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3698fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3699fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3700fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
3701fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
3702fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
3703fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
3704fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3705fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3706fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3707fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3708fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3709fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3710fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3711fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
3712fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
3713fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
3714fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
3715fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
3716fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3717fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3718fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
3719fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
3720fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3721fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3722fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3723fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
3724fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume3\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
3725fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
3726fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
3727fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\setupapi.dll
3728fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
3729fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume3\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
3730fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3731fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3732fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3733fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3734fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3735fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
3736fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
3737fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
3738fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
3739fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc20c90000 LB 0x00067000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
3740fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
3741fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffbf67e0000 LB 0x0085c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
3742fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
3743fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc40740000 LB 0x0003a000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
3744fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IPHLPAPI.DLL
3745fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffbf7040000 LB 0x009e6000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
3746fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
3747fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbf7040000 'C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
3748fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3749fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3750fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3751fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3752fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc222c0000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
3753fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
3754fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc222c0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
3755fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3756fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
3757fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3758fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc094f0000 'C:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
3759fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3760fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
3761fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3762fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbf67e0000 'C:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
3763fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3764fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3765fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3766fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3767fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll) WinVerifyTrust
3768fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
3769fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3770fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3771fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3772fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3773fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3774fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
3775fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc2e8b0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [fFlags=0x0]
3776fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
3777fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc2e8b0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL'
3778fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3779fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3780fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3781fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3782fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll) WinVerifyTrust
3783fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
3784fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3785fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3786fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3787fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3788fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3789fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
3790fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc23b60000 LB 0x00012000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [fFlags=0x0]
3791fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
3792fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc23b60000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL'
3793fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3794fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3795fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3796fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3797fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll) WinVerifyTrust
3798fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
3799fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3800fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3801fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3802fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3803fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3804fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
3805fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc23b40000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [fFlags=0x0]
3806fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
3807fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc23b40000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL'
3808fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3809fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3810fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3811fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3812fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll) WinVerifyTrust
3813fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
3814fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3815fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3816fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3817fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3818fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3819fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
3820fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc23160000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [fFlags=0x0]
3821fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
3822fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc23160000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL'
3823fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3824fc8.304: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3825fc8.304: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3826fc8.304: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
3827fc8.304: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
3828fc8.304: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
3829fc8.304: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
3830fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3831fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3832fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
3833fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
3834fc8.304: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3835fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3836fc8.304: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3837fc8.304: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3838fc8.304: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
3839fc8.304: supR3HardenedDllNotificationCallback: load 00007ffc21f30000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
3840fc8.304: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
3841fc8.304: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc21f30000 'C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
3842fc8.1eb8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3843fc8.1eb8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3844fc8.1eb8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
3845fc8.1eb8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxvmm.dll'.
3846fc8.1eb8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
3847fc8.1eb8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
3848fc8.1eb8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
3849fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3850fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3851fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
3852fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll' [rcNtRedir=0xc0150008]
3853fc8.1eb8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
3854fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
3855fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
3856fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3857fc8.1eb8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3858fc8.1eb8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3859fc8.1eb8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
3860fc8.1eb8: supR3HardenedDllNotificationCallback: load 00007ffc33390000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
3861fc8.1eb8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
3862fc8.1eb8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc33390000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
3863fc8.1cac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3864fc8.1cac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3865fc8.1cac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
3866fc8.1cac: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
3867fc8.1cac: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
3868fc8.1cac: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
3869fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3870fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3871fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
3872fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll' [rcNtRedir=0xc0150008]
3873fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3874fc8.1cac: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3875fc8.1cac: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3876fc8.1cac: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
3877fc8.1cac: supR3HardenedDllNotificationCallback: load 00007ffc306e0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
3878fc8.1cac: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
3879fc8.1cac: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc306e0000 'C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
3880fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3881fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3882fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
3883fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
3884fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll) WinVerifyTrust
3885fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
3886fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
3887fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
3888fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
3889fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll' [rcNtRedir=0xc0150008]
3890fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3891fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
3892fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc30bf0000 LB 0x0000a000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL [fFlags=0x0]
3893fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
3894fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc30bf0000 'C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL'
3895fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3896fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3897fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
3898fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
3899fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'devobj.dll'.
3900fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll) WinVerifyTrust
3901fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
3902fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
3903fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume3\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
3904fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3905fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3906fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'cfgmgr32.dll'.
3907fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\devobj.dll) WinVerifyTrust
3908fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\devobj.dll
3909fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3910fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3911fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
3912fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
3913fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
3914fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
3915fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\cfgmgr32.dll
3916fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3917fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
3918fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
3919fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc41030000 LB 0x0002a000 C:\Windows\System32\DEVOBJ.dll [fFlags=0x0]
3920fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\devobj.dll
3921fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc3b260000 LB 0x00072000 C:\Windows\System32\MMDevApi.dll [fFlags=0x0]
3922fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
3923fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3b260000 'C:\Windows\System32\MMDevApi.dll'
3924fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001134 pwszName=\Device\HarddiskVolume3\Windows\System32\dsound.dll
3925fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3926fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3927fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8184043CF3F3DF1E3CF96E74DBBF7D0836417373
3928fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3929fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3930fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\dsound.dll'
3931fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
3932fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3933fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'winmm.dll'.
3934fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\dsound.dll) WinVerifyTrust
3935fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\dsound.dll
3936fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
3937fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
3938fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
3939fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3940fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3941fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
3942fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
3943fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc20b00000 LB 0x00099000 C:\Windows\System32\dsound.dll [fFlags=0x0]
3944fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
3945fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
3946fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3947fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20b00000 'C:\Windows\System32\dsound.dll'
3948fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20b00000 'C:\Windows\System32\dsound.dll'
3949fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
3950fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3951fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20b00000 'C:\Windows\system32\dsound.dll'
3952fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
3953fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3954fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3b260000 'C:\Windows\System32\MMDEVAPI.DLL'
3955fc8.7b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3956fc8.7b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3957fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
3958fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
3959fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
3960fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'mmdevapi.dll'.
3961fc8.7b8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\AudioSes.dll) WinVerifyTrust
3962fc8.7b8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
3963fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
3964fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
3965fc8.7b8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
3966fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
3967fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume3\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
3968fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3969fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3970fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
3971fc8.7b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
3972fc8.7b8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
3973fc8.7b8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
3974fc8.7b8: supR3HardenedDllNotificationCallback: load 00007ffc3b330000 LB 0x0015d000 C:\Windows\System32\AUDIOSES.DLL [fFlags=0x0]
3975fc8.7b8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\AudioSes.dll
3976fc8.7b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3b330000 'C:\Windows\System32\AUDIOSES.DLL'
3977fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
3978fc8.7b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
3979fc8.7b8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ResourcePolicyClient.dll)
3980fc8.7b8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ResourcePolicyClient.dll
3981fc8.7b8: supR3HardenedDllNotificationCallback: load 00007ffc3f590000 LB 0x00014000 C:\Windows\SYSTEM32\resourcepolicyclient.dll [fFlags=0x0]
3982fc8.7b8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ResourcePolicyClient.dll [avoiding WinVerifyTrust]
3983fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
3984fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
3985fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
3986fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
3987fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3988fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3989fc8.1124: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\ResourcePolicyClient.dll'
3990fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
3991fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
3992fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
3993fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001190 pwszName=\Device\HarddiskVolume3\Windows\System32\wdmaud.drv
3994fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
3995fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
3996fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=38EA8D6D625C6A0A9075DAE17FD33652FF8FC23A
3997fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
3998fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
3999fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\wdmaud.drv'
4000fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
4001fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4002fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'mmdevapi.dll'.
4003fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'ksuser.dll'.
4004fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'avrt.dll'.
4005fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\wdmaud.drv) WinVerifyTrust
4006fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4007fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
4008fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
4009fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4010fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4011fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\avrt.dll) WinVerifyTrust
4012fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\avrt.dll
4013fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ksuser.dll'...
4014fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'ksuser.dll' -> '\Device\HarddiskVolume3\Windows\System32\ksuser.dll' [rcNtRedir=0xc0150008]
4015fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4016fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4017fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4018fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ksuser.dll) WinVerifyTrust
4019fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ksuser.dll
4020fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
4021fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
4022fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
4023fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4024fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4025fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4026fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4027fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4028fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4029fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ksuser.dll
4030fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
4031fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc23150000 LB 0x00009000 C:\Windows\SYSTEM32\ksuser.dll [fFlags=0x0]
4032fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\ksuser.dll
4033fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc3d1b0000 LB 0x0000a000 C:\Windows\SYSTEM32\AVRT.dll [fFlags=0x0]
4034fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\avrt.dll
4035fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc1b4d0000 LB 0x00044000 C:\Windows\System32\wdmaud.drv [fFlags=0x0]
4036fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4037fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc1b4d0000 'C:\Windows\System32\wdmaud.drv'
4038fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4039fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4040fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc1b4d0000 'C:\Windows\System32\wdmaud.drv'
4041fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4042fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4043fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc1b4d0000 'C:\Windows\System32\wdmaud.drv'
4044fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4045fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4046fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc1b4d0000 'C:\Windows\System32\wdmaud.drv'
4047fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wdmaud.drv
4048fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4049fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc1b4d0000 'C:\Windows\System32\wdmaud.drv'
4050fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001194 pwszName=\Device\HarddiskVolume3\Windows\System32\msacm32.drv
4051fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
4052fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
4053fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=763C5E89A8DA653902990733D245B99CC7C40BEA
4054fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4055fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4056fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\msacm32.drv'
4057fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
4058fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4059fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'mmdevapi.dll'.
4060fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'msacm32.dll'.
4061fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'winmmbase.dll'.
4062fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msacm32.drv) WinVerifyTrust
4063fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4064fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
4065fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
4066fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmmbase.dll
4067fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msacm32.dll'...
4068fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msacm32.dll' -> '\Device\HarddiskVolume3\Windows\System32\msacm32.dll' [rcNtRedir=0xc0150008]
4069fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4070fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4071fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4072fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\msacm32.dll) WinVerifyTrust
4073fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\msacm32.dll
4074fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
4075fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume3\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
4076fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\MMDevAPI.dll
4077fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4078fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4079fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4080fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4081fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4082fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4083fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.dll
4084fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc191c0000 LB 0x0001c000 C:\Windows\SYSTEM32\MSACM32.dll [fFlags=0x0]
4085fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.dll
4086fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc22f70000 LB 0x0000d000 C:\Windows\System32\msacm32.drv [fFlags=0x0]
4087fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4088fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4089fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4090fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4091fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4092fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4093fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4094fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4095fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4096fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4097fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4098fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4099fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4100fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4101fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4102fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4103fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4104fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\msacm32.drv
4105fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4106fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4107fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4108fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4109fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc22f70000 'C:\Windows\System32\msacm32.drv'
4110fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000011b0 pwszName=\Device\HarddiskVolume3\Windows\System32\midimap.dll
4111fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000010cfed0
4112fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000010cfed0
4113fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=EB34EC166C3F780657AB67E557E6C2E60C398D10
4114fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4115fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4116fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.18362.535.cat'; file='\Device\HarddiskVolume3\Windows\System32\midimap.dll'
4117fc8.1124: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
4118fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4119fc8.1124: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winmm.dll'.
4120fc8.1124: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\midimap.dll) WinVerifyTrust
4121fc8.1124: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\midimap.dll
4122fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
4123fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume3\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
4124fc8.1124: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\winmm.dll
4125fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4126fc8.1124: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4127fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4128fc8.1124: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
4129fc8.1124: supR3HardenedDllNotificationCallback: load 00007ffc21540000 LB 0x0000a000 C:\Windows\System32\midimap.dll [fFlags=0x0]
4130fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
4131fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc21540000 'C:\Windows\System32\midimap.dll'
4132fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
4133fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4134fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc21540000 'C:\Windows\System32\midimap.dll'
4135fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
4136fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4137fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc21540000 'C:\Windows\System32\midimap.dll'
4138fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\midimap.dll
4139fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000001001:<flags> [calling]
4140fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc21540000 'C:\Windows\System32\midimap.dll'
4141fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4142fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4143fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4144fc8.1124: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\dsound.dll
4145fc8.1124: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
4146fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc20b00000 'C:\Windows\system32\dsound.dll'
4147fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4148fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4149fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3efb0000 'C:\Windows\System32\winmm.dll'
4150fc8.1124: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4151fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4152fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4153fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4154fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
4155fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
4156fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4157fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4158fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4159fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4160fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4161fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4162fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4163fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4164fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4165fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4166fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4167fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4168fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4169fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4170fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4171fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4172fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
4173fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\sspicli.dll)
4174fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\sspicli.dll
4175fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc41120000 LB 0x0002f000 C:\Windows\SYSTEM32\SspiCli.dll [fFlags=0x0]
4176fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\sspicli.dll [avoiding WinVerifyTrust]
4177fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
4178fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
4179fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4180fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\wintrust.dll
4181fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
4182fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc42230000 'C:\Windows\System32\WINTRUST.DLL'
4183fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\CRYPT32.dll'
4184fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4185fc8.25d4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Windows\System32\sspicli.dll'
4186fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\sspicli.dll
4187fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\sspicli.dll (Input=sspicli.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
4188fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41120000 'C:\Windows\System32\sspicli.dll'
4189fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc405a0000 'C:\Windows\system32\rsaenh.dll'
4190fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc41fb0000 'C:\Windows\System32\crypt32.dll'
4191fc8.25d4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
4192fc8.25d4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMELM.DLL) WinVerifyTrust
4193fc8.25d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMELM.DLL
4194fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
4195fc8.25d4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume3\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
4196fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\IME\SHARED\imelm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
4197fc8.25d4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMELM.DLL
4198fc8.25d4: supR3HardenedDllNotificationCallback: load 00007ffc3f050000 LB 0x00058000 C:\Windows\System32\IME\SHARED\imelm.dll [fFlags=0x0]
4199fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\IME\SHARED\IMELM.DLL
4200fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc3f050000 'C:\Windows\System32\IME\SHARED\imelm.dll'
4201fc8.25d4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\shell32.dll
4202fc8.25d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
4203fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4204fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4205fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4206fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4207fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4208fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4209fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4210fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4211fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4212fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4213fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4214fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4215fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4216fc8.25d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc436f0000 'C:\Windows\system32\shell32.dll'
4217fc8.1cac: supR3HardenedDllNotificationCallback: Unload 00007ffc306e0000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [flags=0x0]
4218fc8.1eb8: supR3HardenedDllNotificationCallback: Unload 00007ffc33390000 LB 0x0000c000 C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [flags=0x0]
4219fc8.304: supR3HardenedDllNotificationCallback: Unload 00007ffc21f30000 LB 0x00014000 C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [flags=0x0]
4220fc8.28bc: supR3HardenedDllNotificationCallback: Unload 00007ffc34170000 LB 0x0000d000 C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [flags=0x0]
4221fc8.242c: supR3HardenedDllNotificationCallback: Unload 00007ffc34180000 LB 0x0000f000 C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [flags=0x0]
4222fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc23160000 LB 0x00019000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [flags=0x0]
4223fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc23b40000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [flags=0x0]
4224fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc23b60000 LB 0x00012000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [flags=0x0]
4225fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc2e8b0000 LB 0x00018000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [flags=0x0]
4226fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc222c0000 LB 0x00041000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
4227fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffbf7040000 LB 0x009e6000 C:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [flags=0x0]
4228fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc20c90000 LB 0x00067000 C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [flags=0x0]
4229fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffbf67e0000 LB 0x0085c000 C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [flags=0x0]
4230fc8.1124: supR3HardenedDllNotificationCallback: Unload 00007ffc40740000 LB 0x0003a000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [flags=0x0]
4231fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc32fa0000 LB 0x00038000 C:\Windows\System32\IME\shared\imecfm.dll [flags=0x0]
4232fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3f760000 LB 0x000dc000 C:\Windows\SYSTEM32\wer.dll [flags=0x0]
4233fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc341c0000 LB 0x0000e000 C:\Program Files\Oracle\VirtualBox\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [flags=0x0]
4234fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc305a0000 LB 0x00139000 C:\Windows\System32\IME\shared\imetip.dll [flags=0x0]
4235fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc25de0000 LB 0x00065000 C:\Windows\SYSTEM32\OLEACC.dll [flags=0x0]
4236fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc30960000 LB 0x0014a000 C:\Windows\system32\IME\IMETC\IMTCTIP.DLL [flags=0x0]
4237fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc23480000 LB 0x000a9000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.997_none_2a2bebba46660518\COMCTL32.dll [flags=0x0]
4238fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3b5f0000 LB 0x00086000 C:\Windows\SYSTEM32\policymanager.dll [flags=0x0]
4239fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3da00000 LB 0x0008a000 C:\Windows\SYSTEM32\msvcp110_win.dll [flags=0x0]
4240fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc2fb10000 LB 0x00014000 C:\Windows\system32\wbem\wbemsvc.dll [flags=0x0]
4241fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc30d70000 LB 0x00011000 C:\Windows\system32\wbem\wbemprox.dll [flags=0x0]
4242fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc20e30000 LB 0x001b7000 C:\Windows\System32\IME\shared\mscand20.dll [flags=0x0]
4243fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc33320000 LB 0x00007000 C:\Windows\SYSTEM32\MSIMG32.dll [flags=0x0]
4244fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc31aa0000 LB 0x00093000 C:\Windows\SYSTEM32\DUser.dll [flags=0x0]
4245fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc21110000 LB 0x001b3000 C:\Windows\SYSTEM32\DUI70.dll [flags=0x0]
4246fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc20030000 LB 0x00270000 C:\Windows\SYSTEM32\UIAutomationCore.DLL [flags=0x0]
4247fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc2fd80000 LB 0x00101000 C:\Windows\system32\wbem\fastprox.dll [flags=0x0]
4248fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc310e0000 LB 0x00084000 C:\Windows\SYSTEM32\wbemcomn.dll [flags=0x0]
4249fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3f050000 LB 0x00058000 C:\Windows\System32\IME\SHARED\imelm.dll [flags=0x0]
4250fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc23390000 LB 0x000ef000 C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [flags=0x0]
4251fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc25da0000 LB 0x0003a000 C:\Windows\system32\dataexchange.dll [flags=0x0]
4252fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3e120000 LB 0x0025b000 C:\Windows\system32\d3d11.dll [flags=0x0]
4253fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3fff0000 LB 0x000eb000 C:\Windows\system32\dxgi.dll [flags=0x0]
4254fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3e7e0000 LB 0x001dd000 C:\Windows\system32\dcomp.dll [flags=0x0]
4255fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3f320000 LB 0x00262000 C:\Windows\system32\twinapi.appcore.dll [flags=0x0]
4256fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc3f840000 LB 0x00029000 C:\Windows\system32\RMCLIENT.dll [flags=0x0]
4257fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc20ff0000 LB 0x00118000 C:\Windows\system32\IME\IMETC\IMTCCORE.DLL [flags=0x0]
4258fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc40d00000 LB 0x00026000 C:\Windows\SYSTEM32\ncrypt.dll [flags=0x0]
4259fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc40cc0000 LB 0x0003b000 C:\Windows\SYSTEM32\NTASN1.dll [flags=0x0]
4260fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc32fe0000 LB 0x0004d000 C:\Windows\system32\IME\IMETC\IMTCCFG.DLL [flags=0x0]
4261fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc094f0000 LB 0x003be000 C:\Program Files\Oracle\VirtualBox\VBoxC.dll [flags=0x0]
4262fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc336c0000 LB 0x00081000 C:\Windows\System32\NetSetupShim.dll [flags=0x0]
4263fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc33660000 LB 0x00025000 C:\Windows\System32\NetSetupApi.dll [flags=0x0]
4264fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc42d10000 LB 0x00470000 C:\Windows\System32\setupapi.dll [flags=0x0]
4265fc8.25d4: supR3HardenedDllNotificationCallback: Unload 00007ffc33690000 LB 0x00013000 C:\Windows\System32\DEVRTL.dll [flags=0x0]
4266fc8.25d4: Terminating the normal way: rcExit=0
42672b18.2b1c: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 936219 ms, the end);
426828a0.1c28: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 936603 ms, the end);

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy