140c.1910: Log file opened: 5.2.25r128223 g_hStartupLog=0000000000000034 g_uNtVerCombined=0x63258000
140c.1910: \SystemRoot\System32\ntdll.dll:
140c.1910:     CreationTime:    2018-10-16T20:59:45.432459200Z
140c.1910:     LastWriteTime:   2018-09-08T18:22:37.433413000Z
140c.1910:     ChangeTime:      2019-01-08T19:46:30.261354900Z
140c.1910:     FileAttributes:  0x20
140c.1910:     Size:            0x1a83e0
140c.1910:     NT Headers:      0xd8
140c.1910:     Timestamp:       0x5b93ffa7
140c.1910:     Machine:         0x8664 - amd64
140c.1910:     Timestamp:       0x5b93ffa7
140c.1910:     Image Version:   6.3
140c.1910:     SizeOfImage:     0x1ad000 (1757184)
140c.1910:     Resource Dir:    0x149000 LB 0x62558
140c.1910:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
140c.1910:     [Raw version resource data: 0x1490f0 LB 0x380, codepage 0x0 (reserved 0x0)]
140c.1910:     ProductName:     Microsoft® Windows® Operating System
140c.1910:     ProductVersion:  6.3.9600.19153
140c.1910:     FileVersion:     6.3.9600.19153 (winblue_ltsb.180908-0600)
140c.1910:     FileDescription: NT Layer DLL
140c.1910: \SystemRoot\System32\kernel32.dll:
140c.1910:     CreationTime:    2014-11-24T00:31:49.494633300Z
140c.1910:     LastWriteTime:   2014-10-29T04:09:24.572407200Z
140c.1910:     ChangeTime:      2018-04-10T22:11:10.173275600Z
140c.1910:     FileAttributes:  0x20
140c.1910:     Size:            0x13fc30
140c.1910:     NT Headers:      0xf8
140c.1910:     Timestamp:       0x545054ca
140c.1910:     Machine:         0x8664 - amd64
140c.1910:     Timestamp:       0x545054ca
140c.1910:     Image Version:   6.3
140c.1910:     SizeOfImage:     0x13e000 (1302528)
140c.1910:     Resource Dir:    0x12e000 LB 0x518
140c.1910:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
140c.1910:     [Raw version resource data: 0x12e0b0 LB 0x3a0, codepage 0x0 (reserved 0x0)]
140c.1910:     ProductName:     Microsoft® Windows® Operating System
140c.1910:     ProductVersion:  6.3.9600.17415
140c.1910:     FileVersion:     6.3.9600.17415 (winblue_r4.141028-1500)
140c.1910:     FileDescription: Windows NT BASE API Client DLL
140c.1910: \SystemRoot\System32\KernelBase.dll:
140c.1910:     CreationTime:    2018-11-14T07:45:58.822584100Z
140c.1910:     LastWriteTime:   2018-10-16T03:18:01.101455400Z
140c.1910:     ChangeTime:      2019-01-08T19:46:31.189049900Z
140c.1910:     FileAttributes:  0x20
140c.1910:     Size:            0x115b40
140c.1910:     NT Headers:      0xf0
140c.1910:     Timestamp:       0x5bc006fd
140c.1910:     Machine:         0x8664 - amd64
140c.1910:     Timestamp:       0x5bc006fd
140c.1910:     Image Version:   6.3
140c.1910:     SizeOfImage:     0x116000 (1138688)
140c.1910:     Resource Dir:    0x111000 LB 0x3540
140c.1910:     [Version info resource found at 0x108! (ID/Name: 0x1; SubID/SubName: 0x409)]
140c.1910:     [Raw version resource data: 0x111120 LB 0x3cc, codepage 0x0 (reserved 0x0)]
140c.1910:     ProductName:     Microsoft® Windows® Operating System
140c.1910:     ProductVersion:  6.3.9600.19178
140c.1910:     FileVersion:     6.3.9600.19178 (winblue_ltsb_escrow.181011-1238)
140c.1910:     FileDescription: Windows NT BASE API Client DLL
140c.1910: \SystemRoot\System32\apisetschema.dll:
140c.1910:     CreationTime:    2016-12-13T20:55:41.728231500Z
140c.1910:     LastWriteTime:   2016-10-10T18:18:15.035158100Z
140c.1910:     ChangeTime:      2016-12-19T16:16:51.593108600Z
140c.1910:     FileAttributes:  0x20
140c.1910:     Size:            0x11158
140c.1910:     NT Headers:      0xd0
140c.1910:     Timestamp:       0x57fa67ee
140c.1910:     Machine:         0x8664 - amd64
140c.1910:     Timestamp:       0x57fa67ee
140c.1910:     Image Version:   6.3
140c.1910:     SizeOfImage:     0x12000 (73728)
140c.1910:     Resource Dir:    0x11000 LB 0x3f8
140c.1910:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
140c.1910:     [Raw version resource data: 0x11060 LB 0x398, codepage 0x0 (reserved 0x0)]
140c.1910:     ProductName:     Microsoft® Windows® Operating System
140c.1910:     ProductVersion:  6.3.9600.18513
140c.1910:     FileVersion:     6.3.9600.18513 (winblue_ltsb.161009-0600)
140c.1910:     FileDescription: ApiSet Schema DLL
140c.1910: supR3HardenedWinFindAdversaries: 0x0
140c.1910: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
140c.1910: Calling main()
140c.1910: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
140c.1910: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
140c.1910: SUPR3HardenedMain: Respawn #1
140c.1910: System32:  \Device\HarddiskVolume2\Windows\System32
140c.1910: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
140c.1910: KnownDllPath: C:\Windows\system32
140c.1910: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
140c.1910: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe)
140c.1910: supR3HardNtEnableThreadCreation:
140c.1910: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8c9fa8c90 pvNtTerminateThread=00007ff8ca020c80
140c.1910: supR3HardenedWinDoReSpawn(1): New child 1adc.1578 [kernel32].
140c.1910: supR3HardNtChildGatherData: PebBaseAddress=00007ff66e58f000 cbPeb=0x388
140c.1910: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff8c9f90000 uNtDllChildAddr=00007ff8c9f90000
140c.1910: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff8c9fa8c90
140c.1910: supR3HardenedWinSetupChildInit: Start child.
140c.1910: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
140c.1910: supR3HardNtChildPurify: Startup delay kludge #1/0: 260 ms, 26 sleeps
140c.1910: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
140c.1910:  *0000000000000000-0000000000d0ffff 0x0001/0x0000 0x0000000
140c.1910:  *0000000000d10000-0000000000d2ffff 0x0004/0x0004 0x0020000
140c.1910:  *0000000000d30000-0000000000d3efff 0x0002/0x0002 0x0040000
140c.1910:   0000000000d3f000-0000000000d3ffff 0x0001/0x0000 0x0000000
140c.1910:  *0000000000d40000-0000000000e3afff 0x0000/0x0004 0x0020000
140c.1910:   0000000000e3b000-0000000000e3dfff 0x0104/0x0004 0x0020000
140c.1910:   0000000000e3e000-0000000000e3ffff 0x0004/0x0004 0x0020000
140c.1910:  *0000000000e40000-0000000000e43fff 0x0002/0x0002 0x0040000
140c.1910:   0000000000e44000-0000000000e4ffff 0x0001/0x0000 0x0000000
140c.1910:  *0000000000e50000-0000000000e51fff 0x0004/0x0004 0x0020000
140c.1910:   0000000000e52000-000000007ffdffff 0x0001/0x0000 0x0000000
140c.1910:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
140c.1910:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
140c.1910:   000000007fff0000-00007ff66e55ffff 0x0001/0x0000 0x0000000
140c.1910:  *00007ff66e560000-00007ff66e582fff 0x0002/0x0002 0x0040000
140c.1910:   00007ff66e583000-00007ff66e58cfff 0x0001/0x0000 0x0000000
140c.1910:  *00007ff66e58d000-00007ff66e58efff 0x0004/0x0004 0x0020000
140c.1910:  *00007ff66e58f000-00007ff66e58ffff 0x0004/0x0004 0x0020000
140c.1910:   00007ff66e590000-00007ff66e9fffff 0x0001/0x0000 0x0000000
140c.1910:  *00007ff66ea00000-00007ff66ea00fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66ea01000-00007ff66ea71fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66ea72000-00007ff66ea72fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66ea73000-00007ff66eab9fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eaba000-00007ff66eabafff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eabb000-00007ff66eabbfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eabc000-00007ff66eac0fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eac1000-00007ff66eac1fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eac2000-00007ff66eac2fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eac3000-00007ff66eac6fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eac7000-00007ff66eb0efff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
140c.1910:   00007ff66eb0f000-00007ff8c9f8ffff 0x0001/0x0000 0x0000000
140c.1910:  *00007ff8c9f90000-00007ff8c9f90fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8c9f91000-00007ff8ca0bdfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0be000-00007ff8ca0c3fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0c4000-00007ff8ca0d0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0d1000-00007ff8ca0d1fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0d2000-00007ff8ca0d4fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0d5000-00007ff8ca0d5fff 0x0010/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca0d6000-00007ff8ca13cfff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
140c.1910:   00007ff8ca13d000-00007ffffffdffff 0x0001/0x0000 0x0000000
140c.1910:  *00007ffffffe0000-00007ffffffeffff 0x0001/0x0002 0x0020000
140c.1910: VirtualBox.exe: timestamp 0x5c408cdf (rc=VINF_SUCCESS)
140c.1910: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
140c.1910: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
140c.1910: supR3HardNtChildPurify: Done after 340 ms and 0 fixes (loop #0).
1adc.1578: Log file opened: 5.2.25r128223 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x63258000
1adc.1578: supR3HardenedVmProcessInit: uNtDllAddr=00007ff8c9f90000 g_uNtVerCombined=0x63258000
140c.1910: supR3HardNtEnableThreadCreation:
1adc.1578: ntdll.dll: timestamp 0x5b93ffa7 (rc=VINF_SUCCESS)
1adc.1578: New simple heap: #1 0000000000f60000 LB 0x400000 (for 1757184 allocation)
1adc.1578: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
1adc.1578: System32:  \Device\HarddiskVolume2\Windows\System32
1adc.1578: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
1adc.1578: KnownDllPath: C:\Windows\system32
1adc.1578: supR3HardenedVmProcessInit: Opening vboxdrv stub...
1adc.1578: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
1adc.1578: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
1adc.1578: Registered Dll notification callback with NTDLL.
1adc.1578: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
1adc.1578: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
1adc.1578: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000801:<flags> [calling]
1adc.1578: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1adc.1578: supR3HardenedDllNotificationCallback: load   00007ff8c73d0000 LB 0x00116000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
1adc.1578: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
1adc.1578: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
1adc.1578: supR3HardenedDllNotificationCallback: load   00007ff8c7b80000 LB 0x0013e000 C:\Windows\system32\KERNEL32.DLL [fFlags=0x0]
1adc.1578: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1adc.1578: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7b80000 'C:\Windows\system32\KERNEL32.DLL'
1adc.1578: supR3HardenedDllNotificationCallback: load   00007ff66ea00000 LB 0x0010f000 E:\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe [fFlags=0x0]
1adc.1578: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
1adc.1578: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe)
1adc.1578: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8c9fa8c90 pvNtTerminateThread=00007ff8ca020c80
140c.1910: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 130 ms.
1adc.1578: \SystemRoot\System32\ntdll.dll:
1adc.1578:     CreationTime:    2018-10-16T20:59:45.432459200Z
1adc.1578:     LastWriteTime:   2018-09-08T18:22:37.433413000Z
1adc.1578:     ChangeTime:      2019-01-08T19:46:30.261354900Z
1adc.1578:     FileAttributes:  0x20
1adc.1578:     Size:            0x1a83e0
1adc.1578:     NT Headers:      0xd8
1adc.1578:     Timestamp:       0x5b93ffa7
1adc.1578:     Machine:         0x8664 - amd64
1adc.1578:     Timestamp:       0x5b93ffa7
1adc.1578:     Image Version:   6.3
1adc.1578:     SizeOfImage:     0x1ad000 (1757184)
1adc.1578:     Resource Dir:    0x149000 LB 0x62558
1adc.1578:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
1adc.1578:     [Raw version resource data: 0x1490f0 LB 0x380, codepage 0x0 (reserved 0x0)]
1adc.1578:     ProductName:     Microsoft® Windows® Operating System
1adc.1578:     ProductVersion:  6.3.9600.19153
1adc.1578:     FileVersion:     6.3.9600.19153 (winblue_ltsb.180908-0600)
1adc.1578:     FileDescription: NT Layer DLL
1adc.1578: \SystemRoot\System32\kernel32.dll:
1adc.1578:     CreationTime:    2014-11-24T00:31:49.494633300Z
1adc.1578:     LastWriteTime:   2014-10-29T04:09:24.572407200Z
1adc.1578:     ChangeTime:      2018-04-10T22:11:10.173275600Z
1adc.1578:     FileAttributes:  0x20
1adc.1578:     Size:            0x13fc30
1adc.1578:     NT Headers:      0xf8
1adc.1578:     Timestamp:       0x545054ca
1adc.1578:     Machine:         0x8664 - amd64
1adc.1578:     Timestamp:       0x545054ca
1adc.1578:     Image Version:   6.3
1adc.1578:     SizeOfImage:     0x13e000 (1302528)
1adc.1578:     Resource Dir:    0x12e000 LB 0x518
1adc.1578:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
1adc.1578:     [Raw version resource data: 0x12e0b0 LB 0x3a0, codepage 0x0 (reserved 0x0)]
1adc.1578:     ProductName:     Microsoft® Windows® Operating System
1adc.1578:     ProductVersion:  6.3.9600.17415
1adc.1578:     FileVersion:     6.3.9600.17415 (winblue_r4.141028-1500)
1adc.1578:     FileDescription: Windows NT BASE API Client DLL
1adc.1578: \SystemRoot\System32\KernelBase.dll:
1adc.1578:     CreationTime:    2018-11-14T07:45:58.822584100Z
1adc.1578:     LastWriteTime:   2018-10-16T03:18:01.101455400Z
1adc.1578:     ChangeTime:      2019-01-08T19:46:31.189049900Z
1adc.1578:     FileAttributes:  0x20
1adc.1578:     Size:            0x115b40
1adc.1578:     NT Headers:      0xf0
1adc.1578:     Timestamp:       0x5bc006fd
1adc.1578:     Machine:         0x8664 - amd64
1adc.1578:     Timestamp:       0x5bc006fd
1adc.1578:     Image Version:   6.3
1adc.1578:     SizeOfImage:     0x116000 (1138688)
1adc.1578:     Resource Dir:    0x111000 LB 0x3540
1adc.1578:     [Version info resource found at 0x108! (ID/Name: 0x1; SubID/SubName: 0x409)]
1adc.1578:     [Raw version resource data: 0x111120 LB 0x3cc, codepage 0x0 (reserved 0x0)]
1adc.1578:     ProductName:     Microsoft® Windows® Operating System
1adc.1578:     ProductVersion:  6.3.9600.19178
1adc.1578:     FileVersion:     6.3.9600.19178 (winblue_ltsb_escrow.181011-1238)
1adc.1578:     FileDescription: Windows NT BASE API Client DLL
1adc.1578: \SystemRoot\System32\apisetschema.dll:
1adc.1578:     CreationTime:    2016-12-13T20:55:41.728231500Z
1adc.1578:     LastWriteTime:   2016-10-10T18:18:15.035158100Z
1adc.1578:     ChangeTime:      2016-12-19T16:16:51.593108600Z
1adc.1578:     FileAttributes:  0x20
1adc.1578:     Size:            0x11158
1adc.1578:     NT Headers:      0xd0
1adc.1578:     Timestamp:       0x57fa67ee
1adc.1578:     Machine:         0x8664 - amd64
1adc.1578:     Timestamp:       0x57fa67ee
1adc.1578:     Image Version:   6.3
1adc.1578:     SizeOfImage:     0x12000 (73728)
1adc.1578:     Resource Dir:    0x11000 LB 0x3f8
1adc.1578:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
1adc.1578:     [Raw version resource data: 0x11060 LB 0x398, codepage 0x0 (reserved 0x0)]
1adc.1578:     ProductName:     Microsoft® Windows® Operating System
1adc.1578:     ProductVersion:  6.3.9600.18513
1adc.1578:     FileVersion:     6.3.9600.18513 (winblue_ltsb.161009-0600)
1adc.1578:     FileDescription: ApiSet Schema DLL
1adc.1578: supR3HardenedWinFindAdversaries: 0x0
1adc.1578: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
1adc.1578: Calling main()
1adc.1578: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
1adc.1578: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
1adc.1578: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
1adc.1578: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe)
1adc.1578: SUPR3HardenedMain: Respawn #2
1adc.1578: supR3HardNtEnableThreadCreation:
1adc.1578: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
1adc.1578: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
1adc.1578: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
1adc.1578: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
1adc.1578: supR3HardenedDllNotificationCallback: load   00007ff8c5c80000 LB 0x0008e000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
1adc.1578: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
1adc.1578: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5c80000 'C:\Windows\system32\apphelp.dll'
1adc.1578: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8c9fa8c90 pvNtTerminateThread=00007ff8ca020c80
1adc.1578: supR3HardenedWinDoReSpawn(2): New child 11f0.f30 [kernel32].
1adc.1578: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
1adc.1578: supR3HardNtChildGatherData: PebBaseAddress=00007ff66e73d000 cbPeb=0x388
1adc.1578: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff8c9f90000 uNtDllChildAddr=00007ff8c9f90000
1adc.1578: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff8c9fa8c90
1adc.1578: supR3HardenedWinSetupChildInit: Start child.
1adc.1578: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
1adc.1578: supR3HardNtChildPurify: Startup delay kludge #1/0: 263 ms, 26 sleeps
1adc.1578: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
1adc.1578:  *0000000000000000-000000000029ffff 0x0001/0x0000 0x0000000
1adc.1578:  *00000000002a0000-00000000002bffff 0x0004/0x0004 0x0020000
1adc.1578:  *00000000002c0000-00000000002cefff 0x0002/0x0002 0x0040000
1adc.1578:   00000000002cf000-00000000002cffff 0x0001/0x0000 0x0000000
1adc.1578:  *00000000002d0000-00000000003cafff 0x0000/0x0004 0x0020000
1adc.1578:   00000000003cb000-00000000003cdfff 0x0104/0x0004 0x0020000
1adc.1578:   00000000003ce000-00000000003cffff 0x0004/0x0004 0x0020000
1adc.1578:  *00000000003d0000-00000000003d3fff 0x0002/0x0002 0x0040000
1adc.1578:   00000000003d4000-00000000003dffff 0x0001/0x0000 0x0000000
1adc.1578:  *00000000003e0000-00000000003e1fff 0x0004/0x0004 0x0020000
1adc.1578:   00000000003e2000-000000007ffdffff 0x0001/0x0000 0x0000000
1adc.1578:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
1adc.1578:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
1adc.1578:   000000007fff0000-00007ff66e70ffff 0x0001/0x0000 0x0000000
1adc.1578:  *00007ff66e710000-00007ff66e732fff 0x0002/0x0002 0x0040000
1adc.1578:   00007ff66e733000-00007ff66e73cfff 0x0001/0x0000 0x0000000
1adc.1578:  *00007ff66e73d000-00007ff66e73dfff 0x0004/0x0004 0x0020000
1adc.1578:  *00007ff66e73e000-00007ff66e73ffff 0x0004/0x0004 0x0020000
1adc.1578:   00007ff66e740000-00007ff66e9fffff 0x0001/0x0000 0x0000000
1adc.1578:  *00007ff66ea00000-00007ff66ea00fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66ea01000-00007ff66ea71fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66ea72000-00007ff66ea72fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66ea73000-00007ff66eab9fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eaba000-00007ff66eabafff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eabb000-00007ff66eabbfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eabc000-00007ff66eac0fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eac1000-00007ff66eac1fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eac2000-00007ff66eac2fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eac3000-00007ff66eac6fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eac7000-00007ff66eb0efff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
1adc.1578:   00007ff66eb0f000-00007ff8c9f8ffff 0x0001/0x0000 0x0000000
1adc.1578:  *00007ff8c9f90000-00007ff8c9f90fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8c9f91000-00007ff8ca0bdfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0be000-00007ff8ca0c3fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0c4000-00007ff8ca0d0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0d1000-00007ff8ca0d1fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0d2000-00007ff8ca0d4fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0d5000-00007ff8ca0d5fff 0x0010/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca0d6000-00007ff8ca13cfff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1adc.1578:   00007ff8ca13d000-00007ffffffdffff 0x0001/0x0000 0x0000000
1adc.1578:  *00007ffffffe0000-00007ffffffeffff 0x0001/0x0002 0x0020000
1adc.1578: VirtualBox.exe: timestamp 0x5c408cdf (rc=VINF_SUCCESS)
1adc.1578: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
1adc.1578: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
1adc.1578: supR3HardNtChildPurify: Done after 348 ms and 0 fixes (loop #0).
11f0.f30: Log file opened: 5.2.25r128223 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x63258000
11f0.f30: supR3HardenedVmProcessInit: uNtDllAddr=00007ff8c9f90000 g_uNtVerCombined=0x63258000
11f0.f30: ntdll.dll: timestamp 0x5b93ffa7 (rc=VINF_SUCCESS)
11f0.f30: New simple heap: #1 00000000004f0000 LB 0x400000 (for 1757184 allocation)
1adc.1578: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000f60000 LB 0x400000)
1adc.1578: supR3HardNtEnableThreadCreation:
11f0.f30: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
11f0.f30: System32:  \Device\HarddiskVolume2\Windows\System32
11f0.f30: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
11f0.f30: KnownDllPath: C:\Windows\system32
11f0.f30: supR3HardenedVmProcessInit: Opening vboxdrv...
11f0.f30: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
11f0.f30: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
11f0.f30: Registered Dll notification callback with NTDLL.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c73d0000 LB 0x00116000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7b80000 LB 0x0013e000 C:\Windows\system32\KERNEL32.DLL [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7b80000 'C:\Windows\system32\KERNEL32.DLL'
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff66ea00000 LB 0x0010f000 E:\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe [fFlags=0x0]
11f0.f30: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe
11f0.f30: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8c9fa8c90 pvNtTerminateThread=00007ff8ca020c80
1adc.1578: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 145 ms.
11f0.f30: \SystemRoot\System32\ntdll.dll:
11f0.f30:     CreationTime:    2018-10-16T20:59:45.432459200Z
11f0.f30:     LastWriteTime:   2018-09-08T18:22:37.433413000Z
11f0.f30:     ChangeTime:      2019-01-08T19:46:30.261354900Z
11f0.f30:     FileAttributes:  0x20
11f0.f30:     Size:            0x1a83e0
11f0.f30:     NT Headers:      0xd8
11f0.f30:     Timestamp:       0x5b93ffa7
11f0.f30:     Machine:         0x8664 - amd64
11f0.f30:     Timestamp:       0x5b93ffa7
11f0.f30:     Image Version:   6.3
11f0.f30:     SizeOfImage:     0x1ad000 (1757184)
11f0.f30:     Resource Dir:    0x149000 LB 0x62558
11f0.f30:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
11f0.f30:     [Raw version resource data: 0x1490f0 LB 0x380, codepage 0x0 (reserved 0x0)]
11f0.f30:     ProductName:     Microsoft® Windows® Operating System
11f0.f30:     ProductVersion:  6.3.9600.19153
11f0.f30:     FileVersion:     6.3.9600.19153 (winblue_ltsb.180908-0600)
11f0.f30:     FileDescription: NT Layer DLL
11f0.f30: \SystemRoot\System32\kernel32.dll:
11f0.f30:     CreationTime:    2014-11-24T00:31:49.494633300Z
11f0.f30:     LastWriteTime:   2014-10-29T04:09:24.572407200Z
11f0.f30:     ChangeTime:      2018-04-10T22:11:10.173275600Z
11f0.f30:     FileAttributes:  0x20
11f0.f30:     Size:            0x13fc30
11f0.f30:     NT Headers:      0xf8
11f0.f30:     Timestamp:       0x545054ca
11f0.f30:     Machine:         0x8664 - amd64
11f0.f30:     Timestamp:       0x545054ca
11f0.f30:     Image Version:   6.3
11f0.f30:     SizeOfImage:     0x13e000 (1302528)
11f0.f30:     Resource Dir:    0x12e000 LB 0x518
11f0.f30:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
11f0.f30:     [Raw version resource data: 0x12e0b0 LB 0x3a0, codepage 0x0 (reserved 0x0)]
11f0.f30:     ProductName:     Microsoft® Windows® Operating System
11f0.f30:     ProductVersion:  6.3.9600.17415
11f0.f30:     FileVersion:     6.3.9600.17415 (winblue_r4.141028-1500)
11f0.f30:     FileDescription: Windows NT BASE API Client DLL
11f0.f30: \SystemRoot\System32\KernelBase.dll:
11f0.f30:     CreationTime:    2018-11-14T07:45:58.822584100Z
11f0.f30:     LastWriteTime:   2018-10-16T03:18:01.101455400Z
11f0.f30:     ChangeTime:      2019-01-08T19:46:31.189049900Z
11f0.f30:     FileAttributes:  0x20
11f0.f30:     Size:            0x115b40
11f0.f30:     NT Headers:      0xf0
11f0.f30:     Timestamp:       0x5bc006fd
11f0.f30:     Machine:         0x8664 - amd64
11f0.f30:     Timestamp:       0x5bc006fd
11f0.f30:     Image Version:   6.3
11f0.f30:     SizeOfImage:     0x116000 (1138688)
11f0.f30:     Resource Dir:    0x111000 LB 0x3540
11f0.f30:     [Version info resource found at 0x108! (ID/Name: 0x1; SubID/SubName: 0x409)]
11f0.f30:     [Raw version resource data: 0x111120 LB 0x3cc, codepage 0x0 (reserved 0x0)]
11f0.f30:     ProductName:     Microsoft® Windows® Operating System
11f0.f30:     ProductVersion:  6.3.9600.19178
11f0.f30:     FileVersion:     6.3.9600.19178 (winblue_ltsb_escrow.181011-1238)
11f0.f30:     FileDescription: Windows NT BASE API Client DLL
11f0.f30: \SystemRoot\System32\apisetschema.dll:
11f0.f30:     CreationTime:    2016-12-13T20:55:41.728231500Z
11f0.f30:     LastWriteTime:   2016-10-10T18:18:15.035158100Z
11f0.f30:     ChangeTime:      2016-12-19T16:16:51.593108600Z
11f0.f30:     FileAttributes:  0x20
11f0.f30:     Size:            0x11158
11f0.f30:     NT Headers:      0xd0
11f0.f30:     Timestamp:       0x57fa67ee
11f0.f30:     Machine:         0x8664 - amd64
11f0.f30:     Timestamp:       0x57fa67ee
11f0.f30:     Image Version:   6.3
11f0.f30:     SizeOfImage:     0x12000 (73728)
11f0.f30:     Resource Dir:    0x11000 LB 0x3f8
11f0.f30:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
11f0.f30:     [Raw version resource data: 0x11060 LB 0x398, codepage 0x0 (reserved 0x0)]
11f0.f30:     ProductName:     Microsoft® Windows® Operating System
11f0.f30:     ProductVersion:  6.3.9600.18513
11f0.f30:     FileVersion:     6.3.9600.18513 (winblue_ltsb.161009-0600)
11f0.f30:     FileDescription: ApiSet Schema DLL
11f0.f30: supR3HardenedWinFindAdversaries: 0x0
11f0.f30: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
11f0.f30: Calling main()
11f0.f30: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
11f0.f30: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64'
11f0.f30: '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe' has no imports
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe)
11f0.f30: SUPR3HardenedMain: Final process, opening VBoxDrv...
11f0.f30: supR3HardenedEarlyCompact: Removed heap 1 (0x000000004f0000 LB 0x400000)
11f0.f30: supR3HardNtEnableThreadCreation:
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8bf280000 LB 0x00005000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf280000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf280000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf280000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.DLL'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'crypt32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'msasn1.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'sspicli.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'msasn1.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sspicli.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'sspicli.dll' -> '\Device\HarddiskVolume2\Windows\System32\sspicli.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sspicli.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sspicli.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7d00000 LB 0x000aa000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7170000 LB 0x00011000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7190000 LB 0x001df000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c8380000 LB 0x00059000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c74f0000 LB 0x0002e000 C:\Windows\system32\SspiCli.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c9c70000 LB 0x00140000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7370000 LB 0x00051000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\system32\Wintrust.dll'
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6c70000 LB 0x00026000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6c70000 'C:\Windows\system32\bcrypt.dll'
11f0.f30: bcrypt.dll loaded at 00007ff8c6c70000, BCryptOpenAlgorithmProvider at 00007ff8c6c73490, preloading providers:
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6f90000 LB 0x00063000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6f90000 'C:\Windows\system32\bcryptprimitives.dll'
11f0.f30:     BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=0000000000989480)
11f0.f30:     BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000009897e0)
11f0.f30:     BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=0000000000989910)
11f0.f30:     BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=0000000000989a40)
11f0.f30:     BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=000000000098abc0)
11f0.f30:     BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=000000000098acf0)
11f0.f30:     BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=000000000098af40)
11f0.f30:     BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=000000000098b070)
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c69d0000 LB 0x00020000 C:\Windows\SYSTEM32\CRYPTSP.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcrypt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6630000 LB 0x00036000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'bcryptprimitives.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7000000 LB 0x0000b000 C:\Windows\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7b80000 'C:\Windows\system32\kernel32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\system32\WINTRUST.DLL'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\CRYPT32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\System32\WINTRUST.DLL'
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7620000 LB 0x00016000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'bcrypt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ntasn1.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ncrypt.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ncrypt.dll
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntasn1.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntasn1.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6c00000 LB 0x00037000 C:\Windows\SYSTEM32\NTASN1.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntasn1.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6c40000 LB 0x00025000 C:\Windows\SYSTEM32\ncrypt.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6270000 LB 0x00024000 C:\Windows\SYSTEM32\gpapi.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c70c0000 LB 0x00015000 C:\Windows\SYSTEM32\profapi.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'crypt32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'wldap32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\Wldap32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Wldap32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ntasn1.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ntasn1.dll' -> '\Device\HarddiskVolume2\Windows\System32\ntasn1.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntasn1.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c9a00000 LB 0x0005c000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b02e0000 LB 0x00033000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\system32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b02e0000 'C:\Windows\System32\cryptnet.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'sechost.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c9bb0000 LB 0x000aa000 C:\Windows\SYSTEM32\advapi32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume2\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A12CE9B2F041E73D9396A2492238DF78E14230F7
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9c70000 'C:\Windows\system32\rpcrt4.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_915_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\SystemRoot\System32\ntdll.dll'
11f0.f30: g_pfnWinVerifyTrust=00007ff8c7371050
11f0.f30: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000380 pwszName=\Device\HarddiskVolume2\Windows\System32\Wldap32.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C703EA5C53886AFFF727297D74E706540A242423
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1344_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\Wldap32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000037c pwszName=\Device\HarddiskVolume2\Windows\System32\cryptnet.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7F501A7B907459FED689C7B6483581A8D309E60F
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1344_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ntasn1.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ncrypt.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sspicli.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSupLib.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.exe'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x5088d607dbb19900 CN=ESET SSL Filter CA, O=ESET, spol. s r. o., C=SK
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xf7e2ebbcffed188 CN=GfxTest.com
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xe9c0d0beb86fc500 CN=IntelWorkAround.com
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xe248b7eeee4af00 C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x298be035a30bab00 C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xabd0695c5d11d15e C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x35f812d09650dc00 C=FR, O=Certplus, CN=Class 2 Primary CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x9e5bc2d78b6a3636 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xe66b56ffc86e50a4 C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA, Email=server-certs@thawte.com
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xa8b43f38c3f7b100 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
11f0.f30: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
11f0.f30: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=50
11f0.f30: SUPR3HardenedMain: Load Runtime...
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'nsi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\nsi.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll) WinVerifyTrust
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000596d0000 LB 0x000d2000 E:\PortableApps\Portable-VirtualBox\app64\MSVCR100.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000059630000 LB 0x00098000 E:\PortableApps\Portable-VirtualBox\app64\MSVCP100.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c8440000 LB 0x00009000 C:\Windows\system32\NSI.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c83e0000 LB 0x0005a000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8bb5c0000 LB 0x00598000 E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\nsi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rescheduled]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bb5c0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxRT.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\system32\Wintrust.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: SUPR3HardenedMain: Load TrustedMain...
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5printsupportvbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'winmm.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'winmmbase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmmbase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\winmmbase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'devobj.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmmbase.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmmbase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\devobj.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'cfgmgr32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\devobj.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'combase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\combase.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ole32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #55 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #59 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5OpenGLVBox.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5OpenGLVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5printsupportvbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5printsupportvbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5printsupportvbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5guivbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5guivbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mpr.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mpr.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\ddraw.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'dciman32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ddraw.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ddraw.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\glu32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\dciman32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\dciman32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dciman32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5widgetsvbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winspool.drv'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'comdlg32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5PrintSupportVBox.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5PrintSupportVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comdlg32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'comdlg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'comctl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winspool.drv'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'winspool.drv' -> '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rcNtRedir=0xc0150008]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\winspool.drv'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\winspool.drv)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winspool.drv
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5guivbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
11f0.f30: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\comctl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5guivbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004dc pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2C6D4490D969C3233E8843AD4B11DB3F390C0B16
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1537_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5PrintSupportVBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5OpenGLVBox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\winspool.drv [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\SHCore.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\SHCore.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c80a0000 LB 0x00177000 C:\Windows\system32\USER32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c9a60000 LB 0x0014c000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff89baf0000 LB 0x00009000 C:\Windows\SYSTEM32\DCIMAN32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\dciman32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff89bb00000 LB 0x000f8000 C:\Windows\SYSTEM32\DDRAW.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ddraw.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff89bc00000 LB 0x0002e000 C:\Windows\SYSTEM32\GLU32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff89bc30000 LB 0x0012b000 C:\Windows\SYSTEM32\OPENGL32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7970000 LB 0x00210000 C:\Windows\SYSTEM32\combase.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c8450000 LB 0x00054000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c84d0000 LB 0x0152b000 C:\Windows\system32\SHELL32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7640000 LB 0x00194000 C:\Windows\system32\ole32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c3140000 LB 0x0001e000 C:\Windows\SYSTEM32\MPR.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000590c0000 LB 0x00565000 E:\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8ba5b0000 LB 0x005f7000 E:\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000058b50000 LB 0x00561000 E:\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5WidgetsVBox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b4540000 LB 0x00082000 C:\Windows\SYSTEM32\WINSPOOL.DRV [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\winspool.drv [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8ab5d0000 LB 0x000a4000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\COMCTL32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5580000 LB 0x000b2000 C:\Windows\SYSTEM32\SHCORE.DLL [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c78b0000 LB 0x000b6000 C:\Windows\system32\COMDLG32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8be320000 LB 0x00051000 E:\PortableApps\Portable-VirtualBox\app64\Qt5PrintSupportVBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5PrintSupportVBox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000058af0000 LB 0x00054000 E:\PortableApps\Portable-VirtualBox\app64\Qt5OpenGLVBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5OpenGLVBox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c77e0000 LB 0x000c6000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c75d0000 LB 0x0004f000 C:\Windows\SYSTEM32\cfgmgr32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5ed0000 LB 0x00028000 C:\Windows\SYSTEM32\DEVOBJ.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c4400000 LB 0x0002a000 C:\Windows\SYSTEM32\WINMMBASE.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c4430000 LB 0x00022000 C:\Windows\SYSTEM32\WINMM.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8babb0000 LB 0x00a06000 E:\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\SHCore.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\SHCore.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\comctl32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\winspool.drv'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\winspool.drv' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\dciman32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dciman32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974) '\Device\HarddiskVolume2\Windows\System32\ddraw.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\ddraw.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\devobj.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\winmmbase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\winmmbase.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'msctf.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msctf.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'imm32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [redoing WinVerifyTrust]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
11f0.f30: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
11f0.f30: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\gdi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [redoing WinVerifyTrust]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
11f0.f30: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\imm32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
11f0.f30: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\gdi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c8220000 LB 0x00151000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7cc0000 LB 0x00036000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7cc0000 'C:\Windows\system32\IMM32.DLL'
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msctf.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll' [rescheduled]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rescheduled]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [redoing WinVerifyTrust]
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\imm32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7cc0000 'C:\Windows\system32\imm32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.DLL (Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9bb0000 'C:\Windows\system32\ADVAPI32.DLL'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8babb0000 'E:\PortableApps\Portable-VirtualBox\app64\VirtualBox.dll'
11f0.f30: SUPR3HardenedMain: Calling TrustedMain (00007ff8babb14f0)...
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5guivbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'qt5corevbox.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'msvcr100.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5corevbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5CoreVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\qt5guivbox.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\Qt5GuiVBox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8bd600000 LB 0x0012e000 E:\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd600000 'E:\PortableApps\Portable-VirtualBox\app64\platforms\qwindows.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5f20000 LB 0x0000b000 C:\Windows\SYSTEM32\kernel.appcore.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000005f8 pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=838F7D43C262A37C4054028F21459B37D8042774
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1056_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5da0000 LB 0x00129000 C:\Windows\system32\uxtheme.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5da0000 'C:\Windows\system32\uxtheme.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5da0000 'C:\Windows\system32\uxtheme.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5da0000 'C:\Windows\system32\uxtheme.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5da0000 'C:\Windows\system32\uxtheme.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c80a0000 'C:\Windows\system32\user32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\SHCore.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5580000 'C:\Windows\system32\SHCore.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\Windows\system32\wintab32.dll': 0 (NtPath=\??\C:\Windows\system32\wintab32.dll; Input=C:\Windows\system32\wintab32.dll; rcNtGetDll=0x0
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\Windows\system32\wintab32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5350000 LB 0x00021000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5da0000 'C:\Windows\system32\uxtheme.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9bb0000 'C:\Windows\system32\advapi32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'profapi.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\userenv.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\profapi.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\userenv.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c66d0000 LB 0x00021000 C:\Windows\system32\userenv.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c66d0000 'C:\Windows\system32\userenv.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7b80000 'C:\Windows\system32\kernel32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\clbcatq.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\clbcatq.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c7fe0000 LB 0x000b6000 C:\Windows\SYSTEM32\clbcatq.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\clbcatq.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\clbcatq.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
11f0.1bd0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxC.dll) WinVerifyTrust
11f0.1bd0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxC.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1bd0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxC.dll
11f0.1bd0: supR3HardenedDllNotificationCallback: load   00007ff8ba060000 LB 0x00546000 E:\PortableApps\Portable-VirtualBox\app64\VBoxC.dll [fFlags=0x0]
11f0.1bd0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxC.dll
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ba060000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxC.dll'
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
11f0.1bd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
11f0.1bd0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll) WinVerifyTrust
11f0.1bd0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll [redoing WinVerifyTrust]
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1bd0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1bd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1bd0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll
11f0.1bd0: supR3HardenedDllNotificationCallback: load   00007ff8bdbb0000 LB 0x000ba000 E:\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll [fFlags=0x0]
11f0.1bd0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bdbb0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxProxyStub.dll'
11f0.1bd0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1bd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c77e0000 'C:\Windows\System32\oleaut32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9a60000 'C:\Windows\system32\gdi32.dll'
11f0.1834: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1834: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1834: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
11f0.1834: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.1834: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1834: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1834: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.1834: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll) WinVerifyTrust
11f0.1834: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
11f0.1834: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1834: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1834: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1834: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1834: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.1834: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
11f0.1834: supR3HardenedDllNotificationCallback: load   00007ff8bf0e0000 LB 0x0000e000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [fFlags=0x0]
11f0.1834: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.dll
11f0.1834: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf0e0000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000009f4 pwszName=\Device\HarddiskVolume2\Windows\System32\apphelp.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=42E26D076286ECAAC1729250540377F2004F5DC1
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB3109976~31bf3856ad364e35~amd64~~6.3.1.1.cat'; file='\Device\HarddiskVolume2\Windows\System32\apphelp.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5c80000 LB 0x0008e000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5c80000 'C:\Windows\system32\apphelp.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7640000 'C:\Windows\system32\ole32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7640000 'C:\Windows\system32\ole32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OLEAUT32.dll (Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c77e0000 'C:\Windows\system32\OLEAUT32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a30 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=423F3447A3399AF560C707709A03AE5E23FA1CAD
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_746_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a34 pwszName=\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3E264B83DD0BC4A26011E964C5856C40BC4FD6A4
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_746_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'ws2_32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b5d90000 LB 0x00082000 C:\Windows\SYSTEM32\wbemcomn.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b5e20000 LB 0x00011000 C:\Windows\system32\wbem\wbemprox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
11f0.f30: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c73d0000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b5e20000 'C:\Windows\system32\wbem\wbemprox.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a80 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=34CAAFAC191912291EB7000AE3D54335A7FD4C18
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_746_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b40b0000 LB 0x00015000 C:\Windows\system32\wbem\wbemsvc.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b40b0000 'C:\Windows\system32\wbem\wbemsvc.dll'
11f0.f30: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c73d0000 'api-ms-win-core-localization-l1-2-0.dll'
11f0.f30: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c73d0000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a88 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E1134CFE4D425D2B07CD19B09CEEE997699B71C8
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_560_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b4130000 LB 0x000f9000 C:\Windows\system32\wbem\fastprox.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4130000 'C:\Windows\system32\wbem\fastprox.dll'
11f0.284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrem.dll'.
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.284: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll) WinVerifyTrust
11f0.284: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrem.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrem.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrem.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
11f0.284: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcrt.dll'.
11f0.284: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxREM.dll) WinVerifyTrust
11f0.284: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxREM.dll
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxvmm.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.284: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.284: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.284: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.284: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxREM.dll
11f0.284: supR3HardenedDllNotificationCallback: load   00000000589e0000 LB 0x0010b000 E:\PortableApps\Portable-VirtualBox\app64\VBoxREM.dll [fFlags=0x0]
11f0.284: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxREM.dll
11f0.284: supR3HardenedDllNotificationCallback: load   00007ff8b9d90000 LB 0x002ca000 E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL [fFlags=0x0]
11f0.284: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.284: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b9d90000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\SYSTEM32\WINMM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\SYSTEM32\WINMM.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1318: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1318: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1318: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
11f0.1318: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.1318: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
11f0.1318: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.dll) WinVerifyTrust
11f0.1318: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.dll
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxvmm.dll' [rcNtRedir=0xc0150008]
11f0.1318: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1318: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1318: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.1318: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.dll
11f0.1318: supR3HardenedDllNotificationCallback: load   00007ff8be850000 LB 0x0000b000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.DLL [fFlags=0x0]
11f0.1318: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.dll
11f0.1318: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be850000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.DLL'
11f0.1318: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c80a0000 'C:\Windows\system32\User32.dll'
11f0.10ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
11f0.10ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.10ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.dll) WinVerifyTrust
11f0.10ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.dll
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.10ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10ec: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.dll
11f0.10ec: supR3HardenedDllNotificationCallback: load   00007ff8be830000 LB 0x0000d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.DLL [fFlags=0x0]
11f0.10ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.dll
11f0.10ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be830000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.DLL'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxoglhostcrutil.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxvmm.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxoglrenderspu.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'advapi32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'ole32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'oleaut32.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.dll) WinVerifyTrust
11f0.dcc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxoglrenderspu.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxoglrenderspu.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxoglrenderspu.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxoglhostcrutil.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'advapi32.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll) WinVerifyTrust
11f0.dcc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxvmm.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxoglhostcrutil.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxoglhostcrutil.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxoglhostcrutil.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxoglhostcrutil.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxoglhostcrutil.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxoglhostcrutil.dll' [rcNtRedir=0xc0150008]
11f0.dcc: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shlwapi.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll)
11f0.dcc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shlwapi.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll) WinVerifyTrust
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.dll
11f0.dcc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll [avoiding WinVerifyTrust]
11f0.dcc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll
11f0.dcc: supR3HardenedDllNotificationCallback: load   00007ff8bd8b0000 LB 0x0002f000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll [fFlags=0x0]
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll [avoiding WinVerifyTrust]
11f0.dcc: supR3HardenedDllNotificationCallback: load   00007ff8bd5d0000 LB 0x00026000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll [fFlags=0x0]
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll
11f0.dcc: supR3HardenedDllNotificationCallback: load   00007ff8b9c70000 LB 0x00112000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.DLL [fFlags=0x0]
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b9c70000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.DLL'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll'
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd5d0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxoglhostcrutil.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll) WinVerifyTrust
11f0.dcc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxoglhostcrutil.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxoglhostcrutil.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxoglhostcrutil.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll
11f0.dcc: supR3HardenedDllNotificationCallback: load   00007ff8be460000 LB 0x0001a000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll [fFlags=0x0]
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be460000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll'
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32/opengl32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32/opengl32.dll'
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9a60000 'C:\Windows\system32\gdi32.dll'
11f0.dcc: \Device\HarddiskVolume2\Windows\System32\ig4icd64.dll: Owner is administrators group.
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c34 pwszName=\Device\HarddiskVolume2\Windows\System32\ig4icd64.dll
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=10D1997EE6AAA30EE612C00DD263B954A5106840
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x800b0109; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem10.CAT'; file='\Device\HarddiskVolume2\Windows\System32\ig4icd64.dll'
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=10D1997EE6AAA30EE612C00DD263B954A5106840
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem10.CAT'; file='\Device\HarddiskVolume2\Windows\System32\ig4icd64.dll'
11f0.dcc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
11f0.dcc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.dcc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ig4icd64.dll) WinVerifyTrust
11f0.dcc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ig4icd64.dll
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
11f0.dcc: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
11f0.dcc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ig4icd64.dll (Input=ig4icd64.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ig4icd64.dll
11f0.dcc: supR3HardenedDllNotificationCallback: load   0000000180000000 LB 0x00ef5000 C:\Windows\system32\ig4icd64.dll [fFlags=0x0]
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ig4icd64.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9a60000 'C:\Windows\system32\gdi32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000180000000 'C:\Windows\system32\ig4icd64.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9a60000 'C:\Windows\system32\gdi32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9a60000 'C:\Windows\system32\gdi32.dll'
11f0.dcc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.dcc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.16a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.16a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.16a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
11f0.16a8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.16a8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.dll) WinVerifyTrust
11f0.16a8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.dll
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.16a8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.16a8: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.16a8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.dll
11f0.16a8: supR3HardenedDllNotificationCallback: load   00007ff8be760000 LB 0x0000c000 E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.DLL [fFlags=0x0]
11f0.16a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.dll
11f0.16a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be760000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.DLL'
11f0.1b30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1b30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1b30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
11f0.1b30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.1b30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.dll) WinVerifyTrust
11f0.1b30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.dll
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcp100.dll' [rcNtRedir=0xc0150008]
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1b30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1b30: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.1b30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.dll
11f0.1b30: supR3HardenedDllNotificationCallback: load   00007ff8be720000 LB 0x0000b000 E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.DLL [fFlags=0x0]
11f0.1b30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.dll
11f0.1b30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be720000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.DLL'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\Shell32.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b9d90000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd0e0000 LB 0x00041000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd0e0000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd0e0000 LB 0x00041000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'nsi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winnsi.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winnsi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winnsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\winnsi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\winnsi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'nsi.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winnsi.dll)
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winnsi.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll [lacks WinVerifyTrust]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll [lacks WinVerifyTrust]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'cfgmgr32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'rpcrt4.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxdd2.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [lacks WinVerifyTrust]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxddu.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxvmm.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD.dll
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c9db0000 LB 0x001da000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd8e0000 LB 0x00063000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd0d0000 LB 0x0005d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c2aa0000 LB 0x0000a000 C:\Windows\SYSTEM32\WINNSI.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winnsi.dll [avoiding WinVerifyTrust]
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c2ab0000 LB 0x0002a000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8b8ac0000 LB 0x009cf000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDD.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b8ac0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxDD.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\winnsi.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bcb70000 LB 0x00041000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bcb70000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxC.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ba060000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxC.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd0d0000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxDD2.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd5b0000 LB 0x0001f000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd5b0000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd590000 LB 0x00018000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd590000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd4e0000 LB 0x00018000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd4e0000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd4c0000 LB 0x00019000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd4c0000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1898: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.1898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxvmm.dll'.
11f0.1898: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
11f0.1898: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.dll) WinVerifyTrust
11f0.1898: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.dll
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxvmm.dll'...
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxvmm.dll' [rcNtRedir=0xc0150008]
11f0.1898: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxVMM.dll
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.1898: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.1898: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.1898: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.dll
11f0.1898: supR3HardenedDllNotificationCallback: load   00007ff8be310000 LB 0x0000d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.DLL [fFlags=0x0]
11f0.1898: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.dll
11f0.1898: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be310000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b9d90000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\vboxrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\msvcr100.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8bd260000 LB 0x000cd000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bd260000 'E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VDPluginCrypt.DLL'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Iphlpapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c2ab0000 'C:\Windows\system32\Iphlpapi.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ws2_32.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll)
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8be920000 LB 0x00016000 C:\Windows\SYSTEM32\dhcpcsvc6.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll [avoiding WinVerifyTrust]
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'nsi.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll)
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8beda0000 LB 0x0001a000 C:\Windows\SYSTEM32\dhcpcsvc.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll [avoiding WinVerifyTrust]
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000e5c pwszName=\Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BA7A32ED884F605C3353300D1165178C01A252E7
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll [lacks WinVerifyTrust]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1995_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dhcpcsvc.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ec0 pwszName=\Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=852EBF87DB04C5286E131027705696EE75673482
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1995_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dhcpcsvc6.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'rpcrt4.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'devobj.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll [redoing WinVerifyTrust]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\devobj.dll'
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c4950000 LB 0x00070000 C:\Windows\System32\MMDevApi.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4950000 'C:\Windows\System32\MMDevApi.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000f98 pwszName=\Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=DF2CE4B6EA46F5759902C86AAA15DD883AC6DD4E
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_779_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dsound.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winmm.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'powrprof.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dsound.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'powrprof.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'powrprof.dll' -> '\Device\HarddiskVolume2\Windows\System32\powrprof.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\powrprof.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\powrprof.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\powrprof.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c6700000 LB 0x00046000 C:\Windows\System32\POWRPROF.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\powrprof.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8a3c70000 LB 0x0009d000 C:\Windows\System32\dsound.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\System32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\System32\dsound.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4950000 'C:\Windows\system32\MMDEVAPI.DLL'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fe8 pwszName=\Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=39D0975C289FEE943955B8CE81B02A0395FAA747
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_779_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\wdmaud.drv'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'mmdevapi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'winmm.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'ksuser.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'avrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wdmaud.drv) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\avrt.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\avrt.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ksuser.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'ksuser.dll' -> '\Device\HarddiskVolume2\Windows\System32\ksuser.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ksuser.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ksuser.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ksuser.dll
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\avrt.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c1140000 LB 0x00008000 C:\Windows\SYSTEM32\ksuser.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ksuser.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8c5100000 LB 0x0000c000 C:\Windows\SYSTEM32\AVRT.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\avrt.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8be7f0000 LB 0x0003e000 C:\Windows\system32\wdmaud.drv [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7f0000 'C:\Windows\system32\wdmaud.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7f0000 'C:\Windows\system32\wdmaud.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7f0000 'C:\Windows\system32\wdmaud.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7f0000 'C:\Windows\system32\wdmaud.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wdmaud.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wdmaud.drv (Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7f0000 'C:\Windows\system32\wdmaud.drv'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'mmdevapi.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\AudioSes.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [redoing WinVerifyTrust]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\combase.dll'
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8af7b0000 LB 0x0007e000 C:\Windows\system32\AUDIOSES.DLL [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8af7b0000 'C:\Windows\system32\AUDIOSES.DLL'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000e6c pwszName=\Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FC41C5E1A841A83249581F1B29E14A708B8981A9
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_779_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\msacm32.drv'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'winmm.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msacm32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'mmdevapi.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msacm32.drv) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msacm32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msacm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\msacm32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msacm32.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msacm32.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8be740000 LB 0x0001c000 C:\Windows\SYSTEM32\MSACM32.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8be7e0000 LB 0x0000b000 C:\Windows\system32\msacm32.drv [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msacm32.drv
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msacm32.drv (Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be7e0000 'C:\Windows\system32\msacm32.drv'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001038 pwszName=\Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A0F2984C30BFC77017EA7B9BF6F656853E29D991
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_779_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\midimap.dll'
11f0.10e4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
11f0.10e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'winmm.dll'.
11f0.10e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\midimap.dll) WinVerifyTrust
11f0.10e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.10e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedDllNotificationCallback: load   00007ff8be730000 LB 0x0000a000 C:\Windows\system32\midimap.dll [fFlags=0x0]
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be730000 'C:\Windows\system32\midimap.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be730000 'C:\Windows\system32\midimap.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be730000 'C:\Windows\system32\midimap.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\midimap.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\midimap.dll (Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8be730000 'C:\Windows\system32\midimap.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b9d90000 'E:\PortableApps\Portable-VirtualBox\app64\VBoxVMM.DLL'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.74c: '\Device\HarddiskVolume2\Windows\System32\tzres.dll' has no imports
11f0.74c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\tzres.dll)
11f0.74c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\tzres.dll
11f0.74c: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000009c4 (hFile=0000000000001128) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.74c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\tzres.dll [avoiding WinVerifyTrust]
11f0.74c: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001128 (hFile=00000000000009c4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000010cc pwszName=\Device\HarddiskVolume2\Windows\System32\tzres.dll
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.13ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\system32\WINTRUST.DLL'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\CRYPT32.dll'
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2C2912B1AF73A6796732D1488D75007F742A3299
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.13ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\System32\WINTRUST.DLL'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_5_for_KB2887595~31bf3856ad364e35~amd64~~6.3.2.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\tzres.dll'
11f0.13ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.13ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\tzres.dll'
11f0.13ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dwmapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5350000 'C:\Windows\system32\dwmapi.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\opengl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ig4icd64.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\SYSTEM32\ig4icd64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000180000000 'C:\Windows\SYSTEM32\ig4icd64.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.868: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\avrt.dll
11f0.868: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\avrt.dll (Input=avrt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.868: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5100000 'C:\Windows\system32\avrt.dll'
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000010ec pwszName=\Device\HarddiskVolume2\Windows\System32\mswsock.dll
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62D186BD3F7A84B0BADDB3FC39AE5415D6DEF7D3
11f0.74c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.74c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_8_for_KB3161949~31bf3856ad364e35~amd64~~6.3.1.3.cat'; file='\Device\HarddiskVolume2\Windows\System32\mswsock.dll'
11f0.74c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.74c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.74c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
11f0.74c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mswsock.dll) WinVerifyTrust
11f0.74c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mswsock.dll
11f0.74c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.74c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.74c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.74c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.74c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\mswsock.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.74c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mswsock.dll
11f0.74c: supR3HardenedDllNotificationCallback: load   00007ff8c68e0000 LB 0x00059000 C:\Windows\system32\mswsock.dll [fFlags=0x0]
11f0.74c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mswsock.dll
11f0.74c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c68e0000 'C:\Windows\system32\mswsock.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dwmapi.dll (Input=dwmapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5350000 'C:\Windows\system32\dwmapi.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dsound.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dsound.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\winmm.dll (Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\OPENGL32.dll (Input=OPENGL32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.13ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89bc30000 'C:\Windows\system32\OPENGL32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004d8 pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\system32\WINTRUST.DLL'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\CRYPT32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A8D428FD3A844AF383E2EA2C23013320CECD6296
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7370000 'C:\Windows\System32\WINTRUST.DLL'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1358_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\comdlg32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c78b0000 'C:\Windows\System32\comdlg32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\propsys.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\propsys.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c3720000 LB 0x0017f000 C:\Windows\system32\propsys.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c3720000 'C:\Windows\system32\propsys.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\system32\shell32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000013d0 pwszName=\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=99FE8D01C65C27A7C607A30FF485FD26054B6661
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB3087041~31bf3856ad364e35~amd64~~6.3.1.0.cat'; file='\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c4bb0000 LB 0x0027b000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001458 pwszName=\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E44A2AC53DCA307CA985CD7B698D342049C4465
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2947_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b0450000 LB 0x000ab000 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0450000 'C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001468 pwszName=\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8CFE20E8AAAF5B2BB947F54406382EA8824AC60D
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1059_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'duser.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'dui70.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'imm32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'shcore.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dui70.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'dui70.dll' -> '\Device\HarddiskVolume2\Windows\System32\dui70.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000148c pwszName=\Device\HarddiskVolume2\Windows\System32\dui70.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6E47BBEC94C15C0113C5ED9FB806A83B963F69CA
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1536_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dui70.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dui70.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dui70.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'duser.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'duser.dll' -> '\Device\HarddiskVolume2\Windows\System32\duser.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001434 pwszName=\Device\HarddiskVolume2\Windows\System32\duser.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F172F28417492B929CED4B852712AFC0388DA6FC
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1536_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\duser.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\duser.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\duser.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\explorerframe.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\duser.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dui70.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c4a00000 LB 0x000a4000 C:\Windows\system32\DUser.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\duser.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5390000 LB 0x001c1000 C:\Windows\system32\DUI70.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dui70.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b07a0000 LB 0x002fe000 C:\Windows\system32\explorerframe.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\ntdll.dll'.
11f0.f30: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntdll.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntdll.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c9f90000 'C:\Windows\system32\ntdll.dll'
11f0.f30: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\ntdll.dll'.
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' [rescheduled]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c80a0000 'C:\Windows\system32\user32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b07a0000 'C:\Windows\system32\explorerframe.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\Comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\duser.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\DUser.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4a00000 'C:\Windows\system32\DUser.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c80a0000 'C:\Windows\system32\user32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c5130000 LB 0x001ae000 C:\Windows\SYSTEM32\WindowsCodecs.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001520 pwszName=\Device\HarddiskVolume2\Windows\System32\msftedit.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84CF243E8CE4B7089FF1106D6C37BABB6DE8E9E
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1105_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\msftedit.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'msimg32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msftedit.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msftedit.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msimg32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msimg32.dll' -> '\Device\HarddiskVolume2\Windows\System32\msimg32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000014fc pwszName=\Device\HarddiskVolume2\Windows\System32\msimg32.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=60B3DC6DE12F1CC0001D2707A4D96D264DDC0910
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1536_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\msimg32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msimg32.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msimg32.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\MsftEdit.dll (Input=MsftEdit.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msftedit.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msimg32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b3410000 LB 0x00007000 C:\Windows\SYSTEM32\MSIMG32.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msimg32.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8ab930000 LB 0x002f6000 C:\Windows\system32\MsftEdit.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msftedit.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ab930000 'C:\Windows\system32\MsftEdit.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001508 pwszName=\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4645359BAB7DE186EFA62E0279B3A7A0B86727D0
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_643_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'combase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'bcp47langs.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcp47langs.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcp47langs.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcp47langs.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001538 pwszName=\Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=04D3F65F4FB18C26842881AEBC96B40D961F4B2F
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_868_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\Windows.Globalization.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c4880000 LB 0x00066000 C:\Windows\System32\Bcp47Langs.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b0320000 LB 0x0012b000 C:\Windows\System32\Windows.Globalization.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0320000 'C:\Windows\System32\Windows.Globalization.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'bcp47langs.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'user32.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\globinputhost.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\globinputhost.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b1f60000 LB 0x0002c000 C:\Windows\SYSTEM32\globinputhost.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\globinputhost.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001514 pwszName=\Device\HarddiskVolume2\Windows\System32\globinputhost.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7810F858D01E6774025D359A71E22EE42165D53B
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcp47langs.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcp47langs.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcp47langs.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1358_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\globinputhost.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\globinputhost.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7640000 'C:\Windows\system32\ole32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll [redoing WinVerifyTrust]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c8220000 'C:\Windows\System32\msctf.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c8220000 'C:\Windows\system32\msctf.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\xmllite.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\xmllite.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\xmllite.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c38a0000 LB 0x00039000 C:\Windows\system32\xmllite.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c38a0000 'C:\Windows\system32\xmllite.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001438 pwszName=\Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=25F345185F84A5DA3631831FDA51C75EAC00662E
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_781_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'shcore.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\StructuredQuery.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b24a0000 LB 0x000bc000 C:\Windows\System32\StructuredQuery.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b24a0000 'C:\Windows\System32\StructuredQuery.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001414 pwszName=\Device\HarddiskVolume2\Windows\System32\actxprxy.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5CEA17AE93B7DF7734523AE46F5A530154C2AD2C
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_237_for_KB4483187~31bf3856ad364e35~amd64~~6.3.1.1.cat'; file='\Device\HarddiskVolume2\Windows\System32\actxprxy.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\actxprxy.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\actxprxy.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b0aa0000 LB 0x002c4000 C:\Windows\system32\actxprxy.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0aa0000 'C:\Windows\system32\actxprxy.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000157c pwszName=\Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6B04C422FEE4ACF433314F3637186A776355E87C
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3161_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\atlthunk.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\atlthunk.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8afb40000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001588 (hFile=0000000000001530) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005c0d0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001588 (hFile=0000000000001530) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005c0f0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000015e4 (hFile=00000000000015d0) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005c100000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001550 (hFile=0000000000001518) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001590 pwszName=\Device\HarddiskVolume2\Windows\System32\thumbcache.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B1F5ECB5DF6EB9F42DC2B553162C42F4793C35CE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000015a8 pwszName=\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000005b1e6d20
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005b1e6d20
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1362_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\thumbcache.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'shcore.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'propsys.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\thumbcache.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\thumbcache.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b00e0000 LB 0x0002e000 C:\Windows\System32\thumbcache.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b00e0000 'C:\Windows\System32\thumbcache.dll'
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2CA05B50D69CB3F3B893902C18268D0F99A09FB0
11f0.5dc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.5dc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\xmllite.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c38a0000 'C:\Windows\system32\xmllite.dll'
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1362_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll'
11f0.5dc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.5dc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.5dc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
11f0.5dc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'shell32.dll'.
11f0.5dc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'shlwapi.dll'.
11f0.5dc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'gdi32.dll'.
11f0.5dc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll) WinVerifyTrust
11f0.5dc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.5dc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.5dc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.5dc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.5dc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SearchFolder.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
11f0.5dc: supR3HardenedDllNotificationCallback: load   00007ff8b2560000 LB 0x0013c000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.5dc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
11f0.5dc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2560000 'C:\Windows\system32\SearchFolder.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005d320000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001600 (hFile=0000000000001608) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005d330000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001610 (hFile=00000000000015f4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005d340000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000015b8 (hFile=00000000000015b0) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   000000005d350000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000015e0 (hFile=0000000000001614) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\sspicli.dll (Input=sspicli.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c74f0000 'C:\Windows\system32\sspicli.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\samcli.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\samcli.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b5ac0000 LB 0x00017000 C:\Windows\SYSTEM32\samcli.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\samcli.dll [avoiding WinVerifyTrust]
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\samlib.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\samlib.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c10e0000 LB 0x0001f000 C:\Windows\SYSTEM32\SAMLIB.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\samlib.dll [avoiding WinVerifyTrust]
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001600 pwszName=\Device\HarddiskVolume2\Windows\System32\samlib.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=01B7E745A45A0D19A4C835C9334D48554B610220
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1344_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\samlib.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\samlib.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000160c pwszName=\Device\HarddiskVolume2\Windows\System32\samcli.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8575214EAD0ECE222A9E131174FFA8080329DA19
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\netutils.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\netutils.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6b30000 LB 0x0000c000 C:\Windows\SYSTEM32\netutils.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll [avoiding WinVerifyTrust]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1991_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\samcli.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\samcli.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001670 pwszName=\Device\HarddiskVolume2\Windows\System32\twinapi.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2314D8BBA22BCF8495AB517DDCB488A6A70E0EBA
11f0.17bc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000168c pwszName=\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000005c276d30
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c276d30
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1358_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\twinapi.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'combase.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\twinapi.dll) WinVerifyTrust
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\twinapi.dll
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\twinapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b1fb0000 LB 0x000c9000 C:\Windows\System32\twinapi.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b1fb0000 'C:\Windows\System32\twinapi.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=370927022957FB544DB824FB699D752A59758EB2
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1200_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'oleaut32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shlwapi.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shell32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'propsys.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'gdi32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'user32.dll'.
11f0.17bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll) WinVerifyTrust
11f0.17bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\NetworkExplorer.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.17bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'combase.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8b0d70000 LB 0x000a0000 C:\Windows\System32\twinapi.appcore.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
11f0.17bc: supR3HardenedDllNotificationCallback: load   00007ff8ad670000 LB 0x0019d000 C:\Windows\system32\NetworkExplorer.dll [fFlags=0x0]
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad670000 'C:\Windows\system32\NetworkExplorer.dll'
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000016b4 pwszName=\Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7D7EADEDC39EAC37584E278AC5DE253F64D3F173
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c8220000 'C:\Windows\system32\MSCTF.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000016c8 pwszName=\Device\HarddiskVolume2\Windows\System32\drprov.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000005c272cb0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c272cb0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=744F6A69D70D26E63E7DC4672CFDE303DAB1FBDE
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1200_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'propsys.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
11f0.1434: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll) WinVerifyTrust
11f0.1434: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1469_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\drprov.dll'
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winsta.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\drprov.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\drprov.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winsta.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'winsta.dll' -> '\Device\HarddiskVolume2\Windows\System32\winsta.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\NetworkItemFactory.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1434: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll
11f0.1434: supR3HardenedDllNotificationCallback: load   00007ff8bf340000 LB 0x00012000 C:\Windows\system32\NetworkItemFactory.dll [fFlags=0x0]
11f0.1434: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkitemfactory.dll
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf340000 'C:\Windows\system32\NetworkItemFactory.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000015b8 pwszName=\Device\HarddiskVolume2\Windows\System32\dtsh.dll
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F75AC219E397DFD410E52AFB371EC0B072AEBEA7
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winsta.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winsta.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\drprov.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winsta.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8c6430000 LB 0x0005a000 C:\Windows\System32\WINSTA.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winsta.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b33c0000 LB 0x0000b000 C:\Windows\System32\drprov.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b33c0000 'C:\Windows\System32\drprov.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000016f8 pwszName=\Device\HarddiskVolume2\Windows\System32\ntlanman.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000005c2759b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2759b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A989CBB6A377AA33B42EBFA6396F5BCEE2A8717E
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1201_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dtsh.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'firewallapi.dll'.
11f0.1434: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dtsh.dll) WinVerifyTrust
11f0.1434: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dtsh.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'firewallapi.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'firewallapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\firewallapi.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000016f0 pwszName=\Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=36BD41D621820A5CBC5C0026D33FC063BAB68052
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_744_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\ntlanman.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntlanman.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntlanman.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b2bc0000 LB 0x00017000 C:\Windows\System32\ntlanman.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2bc0000 'C:\Windows\System32\ntlanman.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000016fc pwszName=\Device\HarddiskVolume2\Windows\System32\davclnt.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2759b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2759b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=083756FD3E23D0BEBF512B80E3C2EB28223C9968
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_956_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'combase.dll'.
11f0.1434: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll) WinVerifyTrust
11f0.1434: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dtsh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1434: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dtsh.dll
11f0.1434: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll
11f0.1434: supR3HardenedDllNotificationCallback: load   00007ff8c6020000 LB 0x000bd000 C:\Windows\system32\FirewallAPI.dll [fFlags=0x0]
11f0.1434: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll
11f0.1434: supR3HardenedDllNotificationCallback: load   00007ff8c1010000 LB 0x0000e000 C:\Windows\system32\dtsh.dll [fFlags=0x0]
11f0.1434: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dtsh.dll
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c1010000 'C:\Windows\system32\dtsh.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB3076949~31bf3856ad364e35~amd64~~6.3.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\davclnt.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'davhlpr.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\davclnt.dll) WinVerifyTrust
11f0.1434: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\FirewallAPI.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'davhlpr.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'davhlpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\davhlpr.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001738 pwszName=\Device\HarddiskVolume2\Windows\System32\davhlpr.dll
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=62D34E45157388A13E0368E40016C526D026E694
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_868_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\davhlpr.dll'
11f0.1434: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.1434: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1434: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\davhlpr.dll) WinVerifyTrust
11f0.1434: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.1434: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.1434: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\FirewallAPI.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1434: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6020000 'C:\Windows\System32\FirewallAPI.dll'
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\davclnt.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\davclnt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b2c30000 LB 0x0000c000 C:\Windows\System32\DAVHLPR.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b2b10000 LB 0x0001f000 C:\Windows\System32\davclnt.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2b10000 'C:\Windows\System32\davclnt.dll'
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\drprov.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b33c0000 'C:\Windows\System32\drprov.dll'
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntlanman.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2bc0000 'C:\Windows\System32\ntlanman.dll'
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wkscli.dll)
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wkscli.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8c3520000 LB 0x00017000 C:\Windows\System32\wkscli.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wkscli.dll [avoiding WinVerifyTrust]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wkscli.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001700 pwszName=\Device\HarddiskVolume2\Windows\System32\cscapi.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4CEA92D97A73E66B730ED374991B3158409E5131
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_863_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\cscapi.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cscapi.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cscapi.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cscapi.dll (Input=cscapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b3b20000 LB 0x00012000 C:\Windows\system32\cscapi.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b3b20000 'C:\Windows\system32\cscapi.dll'
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\davclnt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2b10000 'C:\Windows\System32\davclnt.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'shell32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'propsys.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'shlwapi.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'gdi32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'user32.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'sspicli.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ntshrui.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntshrui.dll
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8afb50000 LB 0x000ba000 C:\Windows\SYSTEM32\ntshrui.dll [fFlags=0x0]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\ntshrui.dll [avoiding WinVerifyTrust]
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000172c pwszName=\Device\HarddiskVolume2\Windows\System32\ntshrui.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=29F7E290189F44C9E2400C511C81B73905346BFE
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sspicli.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'sspicli.dll' -> '\Device\HarddiskVolume2\Windows\System32\sspicli.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.f30: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
11f0.f30: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\srvcli.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\srvcli.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.f30: supR3HardenedDllNotificationCallback: load   00007ff8c6f10000 LB 0x00026000 C:\Windows\SYSTEM32\srvcli.dll [fFlags=0x0]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll [avoiding WinVerifyTrust]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1056_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\Device\HarddiskVolume2\Windows\System32\ntshrui.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ntshrui.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001770 pwszName=\Device\HarddiskVolume2\Windows\System32\dlnashext.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=AF2877BB097BD65F6E7F416097CA875A1AE40557
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cscapi.dll (Input=cscapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b3b20000 'C:\Windows\system32\cscapi.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2550_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\dlnashext.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shlwapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dlnashext.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.f30: '\Device\HarddiskVolume2\Windows\System32\imageres.dll' has no imports
11f0.f30: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imageres.dll)
11f0.f30: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001810 (hFile=000000000000181c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dlnashext.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001818 pwszName=\Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009c7ac0
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009c7ac0
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b2c80000 LB 0x0007b000 C:\Windows\System32\dlnashext.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2c80000 'C:\Windows\System32\dlnashext.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001828 pwszName=\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=BE4DFCCE342DD2D2F302EAA3122C34A7722FA2B0
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_931_for_KB4471320~31bf3856ad364e35~amd64~~6.3.1.4.cat'; file='\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'shell32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'ole32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'ws2_32.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\PlayToDevice.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8bf290000 LB 0x0004e000 C:\Windows\System32\PlayToDevice.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bf290000 'C:\Windows\System32\PlayToDevice.dll'
11f0.12b4: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-winrt-string-l1-1-0.dll) -> 0x0, fPresent=1
11f0.12b4: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-winrt-string-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.12b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7970000 'api-ms-win-core-winrt-string-l1-1-0.dll'
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll [redoing WinVerifyTrust]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CFGMGR32.dll (Input=CFGMGR32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c75d0000 'C:\Windows\system32\CFGMGR32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001138 pwszName=\Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=434CC1CFCCBA2677DEA3B3B0D9512CE98BFD4089
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_873_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DevDispItemProvider.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b2c10000 LB 0x0001e000 C:\Windows\System32\DevDispItemProvider.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2c10000 'C:\Windows\System32\DevDispItemProvider.dll'
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001868 pwszName=\Device\HarddiskVolume2\Windows\System32\npmproxy.dll
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4FD8BC5C935D9CFB4B120A9BFC3C7D61D7E92263
11f0.1aa4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.1aa4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1200_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\npmproxy.dll'
11f0.1aa4: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.1aa4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.1aa4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.1aa4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
11f0.1aa4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\npmproxy.dll) WinVerifyTrust
11f0.1aa4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\npmproxy.dll
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.1aa4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.1aa4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\npmproxy.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.1aa4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\npmproxy.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001848 pwszName=\Device\HarddiskVolume2\Windows\System32\wpdshext.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.1aa4: supR3HardenedDllNotificationCallback: load   00007ff8b33a0000 LB 0x0000e000 C:\Windows\System32\npmproxy.dll [fFlags=0x0]
11f0.1aa4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\npmproxy.dll
11f0.1aa4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b33a0000 'C:\Windows\System32\npmproxy.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4619C3CBE29EC05EDBCE45725530EBA9963FAFB4
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB3013531~31bf3856ad364e35~amd64~~6.3.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\wpdshext.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdiplus.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wpdshext.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdiplus.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdiplus.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdiplus.dll' [rcNtRedir=0x0]
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001688 pwszName=\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2D144BD30A4316581C629582ED9B920D0C60EDE8
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1105_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'gdi32.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\GdiPlus.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wpdshext.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'gdi32.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll)
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8af8a0000 LB 0x001b1000 C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\gdiplus.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll [avoiding WinVerifyTrust]
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8bccd0000 LB 0x001fd000 C:\Windows\system32\wpdshext.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8bccd0000 'C:\Windows\system32\wpdshext.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000184c pwszName=\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2D144BD30A4316581C629582ED9B920D0C60EDE8
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1105_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\GdiPlus.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\Comctl32.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\Comctl32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000017f0 pwszName=\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0E0850F6B24B2320F0FCDB23030633FE7603412B
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2690_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\PortableDeviceApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8b3010000 LB 0x000b4000 C:\Windows\System32\PortableDeviceApi.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b3010000 'C:\Windows\System32\PortableDeviceApi.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001880 pwszName=\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FEA73D870E80910B758AA8FA46E23F57F30B517C
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_937_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'oleaut32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'propsys.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'comctl32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'setupapi.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\comctl32.dll [redoing WinVerifyTrust]
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004f8 pwszName=\Device\HarddiskVolume2\Windows\System32\comctl32.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F6522FA6F02EF4787F28DA6C27054084E2173E41
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2_for_KB3059317~31bf3856ad364e35~amd64~~6.3.1.0.cat'; file='\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedScreenImage/Imports: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\comctl32.dll'
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorShell.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8ad630000 LB 0x00037000 C:\Windows\System32\EhStorShell.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad630000 'C:\Windows\System32\EhStorShell.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000017ac pwszName=\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7CA5938834416DB680BBCA9A775A298CE5DC3740
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_937_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll'
11f0.111c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'setupapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shlwapi.dll'.
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'wtsapi32.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wtsapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'wtsapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wtsapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.111c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wtsapi32.dll) WinVerifyTrust
11f0.111c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.111c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.111c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorAPI.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
11f0.111c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8c3670000 LB 0x00012000 C:\Windows\System32\WTSAPI32.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
11f0.111c: supR3HardenedDllNotificationCallback: load   00007ff8c17a0000 LB 0x00026000 C:\Windows\System32\EhStorAPI.dll [fFlags=0x0]
11f0.111c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
11f0.111c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c17a0000 'C:\Windows\System32\EhStorAPI.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7467EB099B57A749CBEA853CF14DF9A93862B832
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package-AutoMerged-shell~31bf3856ad364e35~amd64~~6.3.9600.16384.cat'; file='\Device\HarddiskVolume2\Windows\System32\imageres.dll'
11f0.f30: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.f30: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imageres.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\windowscodecs.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c5130000 'C:\Windows\system32\windowscodecs.dll'
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001704 (hFile=00000000000018e0) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000018e4 (hFile=00000000000017f8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001814 (hFile=0000000000001960) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001264 (hFile=0000000000001268) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msctf.dll (Input=msctf.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c8220000 'C:\Windows\system32\msctf.dll'
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000015c8 (hFile=000000000000196c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001970 (hFile=0000000000001960) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001960 (hFile=0000000000001970) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001980 (hFile=0000000000001988) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001980 (hFile=0000000000001984) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000198c (hFile=0000000000001980) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001980 (hFile=000000000000198c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000199c (hFile=0000000000001998) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019a8 (hFile=00000000000019a4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019a4 (hFile=00000000000019a8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019c0 (hFile=00000000000015c8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001264 (hFile=0000000000001970) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001970 (hFile=00000000000011fc) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001908 (hFile=0000000000001264) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001208 (hFile=00000000000019c4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001204 (hFile=000000000000197c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000197c (hFile=0000000000001248) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019d4 (hFile=00000000000019c8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000123c (hFile=0000000000001244) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001990 (hFile=000000000000198c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019cc (hFile=00000000000019d8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019e8 (hFile=0000000000001990) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019e8 (hFile=0000000000001990) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001220 (hFile=00000000000019e8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001230 (hFile=00000000000017f8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001984 (hFile=000000000000121c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000017f8 (hFile=00000000000019b4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019e8 (hFile=0000000000001984) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001230 (hFile=000000000000123c) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019b4 (hFile=0000000000001984) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.5dc: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000123c (hFile=00000000000019dc) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\System32\shell32.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\System32\shell32.dll'
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorShell.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad630000 'C:\Windows\System32\EhStorShell.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001214 pwszName=\Device\HarddiskVolume2\Windows\System32\cscui.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6C627916E77DF4A074FF7CB4A6591D28BCDF520E
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_2644_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\cscui.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'propsys.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shlwapi.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'cscdll.dll'.
11f0.17bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cscui.dll) WinVerifyTrust
11f0.17bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cscui.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cscdll.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'cscdll.dll' -> '\Device\HarddiskVolume2\Windows\System32\cscdll.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000124c pwszName=\Device\HarddiskVolume2\Windows\System32\cscdll.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C5F59932FD20723EFFF1C88BA3E93EC20A4AB72C
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_863_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat'; file='\Device\HarddiskVolume2\Windows\System32\cscdll.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.17bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cscdll.dll) WinVerifyTrust
11f0.17bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cscdll.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cscui.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.17bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscui.dll
11f0.17bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscdll.dll
11f0.17bc: supR3HardenedDllNotificationCallback: load   00007ff8c3950000 LB 0x0000d000 C:\Windows\System32\CSCDLL.dll [fFlags=0x0]
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscdll.dll
11f0.17bc: supR3HardenedDllNotificationCallback: load   00007ff8b23f0000 LB 0x000ac000 C:\Windows\System32\cscui.dll [fFlags=0x0]
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscui.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4bb0000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8\comctl32.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23f0000 'C:\Windows\System32\cscui.dll'
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscui.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cscui.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23f0000 'C:\Windows\System32\cscui.dll'
11f0.1434: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019d0 (hFile=0000000000001a28) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001a28 pwszName=\Device\HarddiskVolume2\Windows\System32\mssprxy.dll
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000005c2753b0
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6563F4F7CE10DE2B171B266EFF99123FDBC6AAB3
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c6630000 'C:\Windows\system32\rsaenh.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c7190000 'C:\Windows\system32\crypt32.dll'
11f0.111c: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001a2c (hFile=0000000000001a44) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1931_for_KB4480963~31bf3856ad364e35~amd64~~6.3.1.5.cat'; file='\Device\HarddiskVolume2\Windows\System32\mssprxy.dll'
11f0.17bc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
11f0.17bc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'combase.dll'.
11f0.17bc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mssprxy.dll) WinVerifyTrust
11f0.17bc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
11f0.17bc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\mssprxy.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
11f0.17bc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
11f0.17bc: supR3HardenedDllNotificationCallback: load   00007ff8acf90000 LB 0x00025000 C:\Windows\system32\mssprxy.dll [fFlags=0x0]
11f0.17bc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8acf90000 'C:\Windows\system32\mssprxy.dll'
11f0.17bc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c84d0000 'C:\Windows\System32\shell32.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000004d20000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000041c (hFile=00000000000003b8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000051c0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000175c (hFile=00000000000003b8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000051d0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000175c (hFile=00000000000003b8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000051e0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000175c (hFile=00000000000003b8) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000000740000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000408 (hFile=0000000000001900) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000003270000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000408 (hFile=0000000000001900) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000420 (hFile=0000000000001860) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000019c (hFile=0000000000001860) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001860 (hFile=0000000000000420) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000032b0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000188c (hFile=0000000000000410) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000059d0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000188c (hFile=0000000000000410) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
11f0.f30: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000005a00000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000188c (hFile=0000000000000410) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000016510000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000188c (hFile=0000000000000410) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   00000000032a0000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019a8 (hFile=0000000000001860) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedDllNotificationCallback: load   0000000016a20000 LB 0x0000f000 C:\Windows\system32\atlthunk.dll [fFlags=0x0]
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000018ac (hFile=0000000000001860) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000142 'C:\Windows\system32\atlthunk.dll'
11f0.f30: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000017a0 (hFile=00000000000004c4) with 0xc0000022 -> STATUS_TRUST_FAILURE
11f0.f30: supR3HardenedDllNotificationCallback: Unload 00007ff8ab930000 LB 0x002f6000 C:\Windows\system32\MsftEdit.dll [flags=0x0]
11f0.f30: supR3HardenedDllNotificationCallback: Unload 00007ff8b3410000 LB 0x00007000 C:\Windows\SYSTEM32\MSIMG32.dll [flags=0x0]
11f0.f30: supR3HardenedDllNotificationCallback: Unload 00007ff8c38a0000 LB 0x00039000 C:\Windows\system32\xmllite.dll [flags=0x0]
11f0.111c: supR3HardenedDllNotificationCallback: Unload 00007ff8bccd0000 LB 0x001fd000 C:\Windows\system32\wpdshext.dll [flags=0x0]
11f0.111c: supR3HardenedDllNotificationCallback: Unload 00007ff8af8a0000 LB 0x001b1000 C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.19202_none_932a8377475097fb\gdiplus.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8c17a0000 LB 0x00026000 C:\Windows\System32\EhStorAPI.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8c3670000 LB 0x00012000 C:\Windows\System32\WTSAPI32.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8b3010000 LB 0x000b4000 C:\Windows\System32\PortableDeviceApi.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8b33a0000 LB 0x0000e000 C:\Windows\System32\npmproxy.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8bf290000 LB 0x0004e000 C:\Windows\System32\PlayToDevice.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8c1010000 LB 0x0000e000 C:\Windows\system32\dtsh.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8c6020000 LB 0x000bd000 C:\Windows\system32\FirewallAPI.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8bf340000 LB 0x00012000 C:\Windows\system32\NetworkItemFactory.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8b2560000 LB 0x0013c000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8b0320000 LB 0x0012b000 C:\Windows\System32\Windows.Globalization.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8b1f60000 LB 0x0002c000 C:\Windows\SYSTEM32\globinputhost.dll [flags=0x0]
11f0.184c: supR3HardenedDllNotificationCallback: Unload 00007ff8c4880000 LB 0x00066000 C:\Windows\System32\Bcp47Langs.dll [flags=0x0]
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a3c70000 'C:\Windows\system32\dsound.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.10e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8c4430000 'C:\Windows\system32\winmm.dll'
11f0.1898: supR3HardenedDllNotificationCallback: Unload 00007ff8be310000 LB 0x0000d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedFolders.DLL [flags=0x0]
11f0.1b30: supR3HardenedDllNotificationCallback: Unload 00007ff8be720000 LB 0x0000b000 E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestControlSvc.DLL [flags=0x0]
11f0.16a8: supR3HardenedDllNotificationCallback: Unload 00007ff8be760000 LB 0x0000c000 E:\PortableApps\Portable-VirtualBox\app64\VBoxGuestPropSvc.DLL [flags=0x0]
11f0.dcc: supR3HardenedDllNotificationCallback: Unload 00007ff8be460000 LB 0x0001a000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhosterrorspu.dll [flags=0x0]
11f0.dcc: supR3HardenedDllNotificationCallback: Unload 00007ff8b9c70000 LB 0x00112000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedCrOpenGL.DLL [flags=0x0]
11f0.dcc: supR3HardenedDllNotificationCallback: Unload 00007ff8bd5d0000 LB 0x00026000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLrenderspu.dll [flags=0x0]
11f0.dcc: supR3HardenedDllNotificationCallback: Unload 00007ff8bd8b0000 LB 0x0002f000 E:\PortableApps\Portable-VirtualBox\app64\VBoxOGLhostcrutil.dll [flags=0x0]
11f0.10ec: supR3HardenedDllNotificationCallback: Unload 00007ff8be830000 LB 0x0000d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDragAndDropSvc.DLL [flags=0x0]
11f0.1318: supR3HardenedDllNotificationCallback: Unload 00007ff8be850000 LB 0x0000b000 E:\PortableApps\Portable-VirtualBox\app64\VBoxSharedClipboard.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd4c0000 LB 0x00019000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbWebcamR3.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd4e0000 LB 0x00018000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxUsbCardReaderR3.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd590000 LB 0x00018000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxNvmeR3.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd5b0000 LB 0x0001f000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxEhciR3.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bcb70000 LB 0x00041000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxHostWebcam.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8b8ac0000 LB 0x009cf000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDD.DLL [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd8e0000 LB 0x00063000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDDU.dll [flags=0x0]
11f0.10e4: supR3HardenedDllNotificationCallback: Unload 00007ff8bd0d0000 LB 0x0005d000 E:\PortableApps\Portable-VirtualBox\app64\VBoxDD2.dll [flags=0x0]
11f0.f30: supR3HardenedDllNotificationCallback: Unload 00007ff8bf0e0000 LB 0x0000e000 E:\PortableApps\Portable-VirtualBox\app64\ExtensionPacks\Oracle_VM_VirtualBox_Extension_Pack\win.amd64\VBoxPuelMainVM.DLL [flags=0x0]
11f0.f30: Terminating the normal way: rcExit=0
1adc.1578: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 58672623 ms, the end);
140c.1910: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 58673156 ms, the end);
