20fc.2fc4: Log file opened: 6.1.8r137981 g_hStartupLog=0000000000000014 g_uNtVerCombined=0x611db110
20fc.2fc4: \SystemRoot\System32\ntdll.dll:
20fc.2fc4:     CreationTime:    2018-06-14T12:26:46.531613700Z
20fc.2fc4:     LastWriteTime:   2018-06-14T12:26:46.534613800Z
20fc.2fc4:     ChangeTime:      2023-01-30T09:00:48.943260400Z
20fc.2fc4:     FileAttributes:  0x20
20fc.2fc4:     Size:            0x196938
20fc.2fc4:     NT Headers:      0xe0
20fc.2fc4:     Timestamp:       0x5b0cbc1e
20fc.2fc4:     Machine:         0x8664 - amd64
20fc.2fc4:     Timestamp:       0x5b0cbc1e
20fc.2fc4:     Image Version:   6.1
20fc.2fc4:     SizeOfImage:     0x19f000 (1699840)
20fc.2fc4:     Resource Dir:    0x142000 LB 0x5a038
20fc.2fc4:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
20fc.2fc4:     [Raw version resource data: 0x1420f0 LB 0x38c, codepage 0x0 (reserved 0x0)]
20fc.2fc4:     ProductName:     Microsoft® Windows® Operating System
20fc.2fc4:     ProductVersion:  6.1.7601.24150
20fc.2fc4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
20fc.2fc4:     FileDescription: NT Layer DLL
20fc.2fc4: \SystemRoot\System32\kernel32.dll:
20fc.2fc4:     CreationTime:    2018-06-14T12:26:46.574616100Z
20fc.2fc4:     LastWriteTime:   2018-06-14T12:26:46.577616300Z
20fc.2fc4:     ChangeTime:      2023-01-30T09:00:33.536976100Z
20fc.2fc4:     FileAttributes:  0x20
20fc.2fc4:     Size:            0x11c000
20fc.2fc4:     NT Headers:      0xe0
20fc.2fc4:     Timestamp:       0x5b0cbc64
20fc.2fc4:     Machine:         0x8664 - amd64
20fc.2fc4:     Timestamp:       0x5b0cbc64
20fc.2fc4:     Image Version:   6.1
20fc.2fc4:     SizeOfImage:     0x11f000 (1175552)
20fc.2fc4:     Resource Dir:    0x116000 LB 0x530
20fc.2fc4:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
20fc.2fc4:     [Raw version resource data: 0x1160b0 LB 0x3b0, codepage 0x0 (reserved 0x0)]
20fc.2fc4:     ProductName:     Microsoft® Windows® Operating System
20fc.2fc4:     ProductVersion:  6.1.7601.24150
20fc.2fc4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
20fc.2fc4:     FileDescription: Windows NT BASE API Client DLL
20fc.2fc4: \SystemRoot\System32\KernelBase.dll:
20fc.2fc4:     CreationTime:    2018-06-14T12:26:46.649620400Z
20fc.2fc4:     LastWriteTime:   2018-06-14T12:26:46.650620500Z
20fc.2fc4:     ChangeTime:      2023-01-30T09:00:33.536976100Z
20fc.2fc4:     FileAttributes:  0x20
20fc.2fc4:     Size:            0x66800
20fc.2fc4:     NT Headers:      0xe8
20fc.2fc4:     Timestamp:       0x5b0cbc65
20fc.2fc4:     Machine:         0x8664 - amd64
20fc.2fc4:     Timestamp:       0x5b0cbc65
20fc.2fc4:     Image Version:   6.1
20fc.2fc4:     SizeOfImage:     0x6a000 (434176)
20fc.2fc4:     Resource Dir:    0x68000 LB 0x538
20fc.2fc4:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
20fc.2fc4:     [Raw version resource data: 0x680b0 LB 0x3b8, codepage 0x0 (reserved 0x0)]
20fc.2fc4:     ProductName:     Microsoft® Windows® Operating System
20fc.2fc4:     ProductVersion:  6.1.7601.24150
20fc.2fc4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
20fc.2fc4:     FileDescription: Windows NT BASE API Client DLL
20fc.2fc4: \SystemRoot\System32\apisetschema.dll:
20fc.2fc4:     CreationTime:    2018-06-14T12:26:46.541614200Z
20fc.2fc4:     LastWriteTime:   2018-06-14T12:26:46.542614300Z
20fc.2fc4:     ChangeTime:      2023-01-30T09:00:10.974423400Z
20fc.2fc4:     FileAttributes:  0x20
20fc.2fc4:     Size:            0x1c00
20fc.2fc4:     NT Headers:      0xc0
20fc.2fc4:     Timestamp:       0x5b0cbbfe
20fc.2fc4:     Machine:         0x8664 - amd64
20fc.2fc4:     Timestamp:       0x5b0cbbfe
20fc.2fc4:     Image Version:   6.1
20fc.2fc4:     SizeOfImage:     0x50000 (327680)
20fc.2fc4:     Resource Dir:    0x30000 LB 0x408
20fc.2fc4:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
20fc.2fc4:     [Raw version resource data: 0x30060 LB 0x3a4, codepage 0x0 (reserved 0x0)]
20fc.2fc4:     ProductName:     Microsoft® Windows® Operating System
20fc.2fc4:     ProductVersion:  6.1.7601.24150
20fc.2fc4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
20fc.2fc4:     FileDescription: ApiSet Schema DLL
20fc.2fc4: supR3HardenedWinFindAdversaries: 0x0
20fc.2fc4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume10\Programs\WM Box'
20fc.2fc4: Calling main()
20fc.2fc4: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
20fc.2fc4: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume10\Programs\WM Box'
20fc.2fc4: SUPR3HardenedMain: Respawn #1
20fc.2fc4: System32:  \Device\HarddiskVolume1\Windows\System32
20fc.2fc4: WinSxS:    \Device\HarddiskVolume1\Windows\winsxs
20fc.2fc4: KnownDllPath: C:\Windows\system32
20fc.2fc4: supR3HardenedWinInit: Performing a limited self purification...
20fc.2fc4: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
20fc.2fc4:  *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000010000-000000000001ffff 0x0004/0x0004 0x0040000
20fc.2fc4:   0000000000020000-000000000002ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
20fc.2fc4:   0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
20fc.2fc4:   0000000000041000-000000000004ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000050000-00000000000b6fff 0x0002/0x0002 0x0040000
20fc.2fc4:   00000000000b7000-00000000000bffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *00000000000c0000-0000000000179fff 0x0000/0x0004 0x0020000
20fc.2fc4:   000000000017a000-000000000017bfff 0x0104/0x0004 0x0020000
20fc.2fc4:   000000000017c000-00000000001bffff 0x0004/0x0004 0x0020000
20fc.2fc4:   00000000001c0000-000000000024ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000250000-0000000000253fff 0x0004/0x0004 0x0020000
20fc.2fc4:   0000000000254000-000000000034ffff 0x0000/0x0004 0x0020000
20fc.2fc4:   0000000000350000-000000000047ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000480000-00000000004e3fff 0x0004/0x0004 0x0020000
20fc.2fc4:   00000000004e4000-00000000004fffff 0x0000/0x0004 0x0020000
20fc.2fc4:  *0000000000500000-000000000069ffff 0x0004/0x0004 0x0020000
20fc.2fc4:   00000000006a0000-0000000076c3ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000076c40000-0000000076c40fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\kernel32.dll
20fc.2fc4:   0000000076c41000-0000000076cdbfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\kernel32.dll
20fc.2fc4:   0000000076cdc000-0000000076d49fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\kernel32.dll
20fc.2fc4:   0000000076d4a000-0000000076d4bfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\kernel32.dll
20fc.2fc4:   0000000076d4c000-0000000076d5efff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\kernel32.dll
20fc.2fc4:   0000000076d5f000-0000000076d5ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000076d60000-0000000076d60fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076d61000-0000000076e84fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e85000-0000000076e86fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e87000-0000000076e88fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e89000-0000000076e8afff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e8b000-0000000076e8dfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e8e000-0000000076e90fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e91000-0000000076e93fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e94000-0000000076efefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076eff000-000000007efdffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000000007efe0000-000000007efe4fff 0x0002/0x0002 0x0040000
20fc.2fc4:   000000007efe5000-000000007f0dffff 0x0000/0x0002 0x0040000
20fc.2fc4:  *000000007f0e0000-000000007ffdffff 0x0000/0x0002 0x0020000
20fc.2fc4:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
20fc.2fc4:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
20fc.2fc4:   000000007fff0000-000000013fb1ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000000013fb20000-000000013fb20fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb21000-000000013fb96fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb97000-000000013fb97fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb98000-000000013fbdffff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe0000-000000013fbe2fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe3000-000000013fbe5fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe6000-000000013fbe8fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe9000-000000013fbe9fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbea000-000000013fbebfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbec000-000000013fbecfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbed000-000000013fc35fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fc36000-000007fefcd7ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fefcd80000-000007fefcd80fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
20fc.2fc4:   000007fefcd81000-000007fefcdc9fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
20fc.2fc4:   000007fefcdca000-000007fefcddefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
20fc.2fc4:   000007fefcddf000-000007fefcde0fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
20fc.2fc4:   000007fefcde1000-000007fefcde9fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
20fc.2fc4:   000007fefcdea000-000007feff05ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007feff060000-000007feff060fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\apisetschema.dll
20fc.2fc4:   000007feff061000-000007fffffaffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
20fc.2fc4:   000007fffffd3000-000007fffffdbfff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fffffdc000-000007fffffdcfff 0x0004/0x0004 0x0020000
20fc.2fc4:   000007fffffdd000-000007fffffddfff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fffffde000-000007fffffdffff 0x0004/0x0004 0x0020000
20fc.2fc4:  *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
20fc.2fc4: apisetschema.dll: timestamp 0x5b0cbbfe (rc=VINF_SUCCESS)
20fc.2fc4: kernelbase.dll: timestamp 0x5b0cbc65 (rc=VINF_SUCCESS)
20fc.2fc4: VirtualBoxVM.exe: timestamp 0x5ebd9c8a (rc=VINF_SUCCESS)
20fc.2fc4: kernel32.dll: timestamp 0x5b0cbc64 (rc=VINF_SUCCESS)
20fc.2fc4: '\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe' has no imports
20fc.2fc4: '\Device\HarddiskVolume1\Windows\System32\apisetschema.dll' has no imports
20fc.2fc4: '\Device\HarddiskVolume1\Windows\System32\ntdll.dll' has no imports
20fc.2fc4: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0
20fc.2fc4: '\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe' has no imports
20fc.2fc4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe)
20fc.2fc4: supR3HardNtEnableThreadCreationEx:
20fc.2fc4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076da3740 pvNtTerminateThread=0000000076dc9dd0
20fc.2fc4: supR3HardenedWinDoReSpawn(1): New child 2a34.29b4 [kernel32].
20fc.2fc4: supR3HardNtChildGatherData: PebBaseAddress=000007fffffdf000 cbPeb=0x380
20fc.2fc4: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076d60000 uNtDllChildAddr=0000000076d60000
20fc.2fc4: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076da3740
20fc.2fc4: supR3HardenedWinSetupChildInit: Initial context:
  rax=0000000000000000 rbx=0000000000000000 rcx=000000013fb27900 rdx=000007fffffdf000
  rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  r14=0000000000000000 r15=0000000000000000  P1=0000000000000000  P2=0000000000000000
  rip=0000000076db3820 rsp=000000000021f808 rbp=0000000000000000    ctxflags=0010001b
  cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000    eflags=00000200   mxcrx=00001f80
   P3=0000000000000000  P4=0000000000000000  P5=0000000000000000  P6=0000000000000000
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
20fc.2fc4: supR3HardenedWinSetupChildInit: Start child.
20fc.2fc4: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
20fc.2fc4: supR3HardNtChildPurify: Startup delay kludge #1/0: 258 ms, 32 sleeps
20fc.2fc4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
20fc.2fc4:  *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
20fc.2fc4:  *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
20fc.2fc4:   0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
20fc.2fc4:   0000000000041000-000000000011ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000000120000-000000000021bfff 0x0000/0x0004 0x0020000
20fc.2fc4:   000000000021c000-000000000021dfff 0x0104/0x0004 0x0020000
20fc.2fc4:   000000000021e000-000000000021ffff 0x0004/0x0004 0x0020000
20fc.2fc4:   0000000000220000-0000000076d5ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *0000000076d60000-0000000076d60fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076d61000-0000000076e84fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e85000-0000000076e8afff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e8b000-0000000076e8bfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e8c000-0000000076e93fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076e94000-0000000076efefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
20fc.2fc4:   0000000076eff000-000000007efdffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
20fc.2fc4:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
20fc.2fc4:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
20fc.2fc4:   000000007fff0000-000000013fb1ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000000013fb20000-000000013fb20fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb21000-000000013fb96fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb97000-000000013fb97fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fb98000-000000013fbdffff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe0000-000000013fbe0fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe1000-000000013fbe1fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe2000-000000013fbe6fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe7000-000000013fbe7fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe8000-000000013fbe8fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbe9000-000000013fbecfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fbed000-000000013fc35fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
20fc.2fc4:   000000013fc36000-000007feff05ffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007feff060000-000007feff060fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\apisetschema.dll
20fc.2fc4:   000007feff061000-000007fffffaffff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
20fc.2fc4:   000007fffffd3000-000007fffffdcfff 0x0001/0x0000 0x0000000
20fc.2fc4:  *000007fffffdd000-000007fffffdefff 0x0004/0x0004 0x0020000
20fc.2fc4:  *000007fffffdf000-000007fffffdffff 0x0004/0x0004 0x0020000
20fc.2fc4:  *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
20fc.2fc4: supR3HardNtChildPurify: Done after 272 ms and 0 fixes (loop #0).
2a34.29b4: Log file opened: 6.1.8r137981 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
2a34.29b4: supR3HardenedVmProcessInit: uNtDllAddr=0000000076d60000 g_uNtVerCombined=0x611db100 (stack ~000000000021f2b8)
2a34.29b4: ntdll.dll: timestamp 0x5b0cbc1e (rc=VINF_SUCCESS)
2a34.29b4: New simple heap: #1 0000000000320000 LB 0x400000 (for 1699840 allocation)
20fc.2fc4: supR3HardNtEnableThreadCreationEx:
2a34.29b4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume10\Programs\WM Box'
2a34.29b4: System32:  \Device\HarddiskVolume1\Windows\System32
2a34.29b4: WinSxS:    \Device\HarddiskVolume1\Windows\winsxs
2a34.29b4: KnownDllPath: C:\Windows\system32
2a34.29b4: supR3HardenedVmProcessInit: Opening vboxdrv stub...
2a34.29b4: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
2a34.29b4: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
2a34.29b4: Registered Dll notification callback with NTDLL.
2a34.29b4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\kernel32.dll)
2a34.29b4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\kernel32.dll
2a34.29b4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
2a34.29b4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
2a34.29b4: supR3HardenedDllNotificationCallback: load   0000000076c40000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
2a34.29b4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
2a34.29b4: supR3HardenedDllNotificationCallback: load   000007fefcd80000 LB 0x0006a000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
2a34.29b4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\KernelBase.dll)
2a34.29b4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
2a34.29b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076c40000 'C:\Windows\system32\kernel32.dll'
2a34.29b4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076da3740 pvNtTerminateThread=0000000076dc9dd0
20fc.2fc4: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 46 ms.
2a34.29b4: \SystemRoot\System32\ntdll.dll:
2a34.29b4:     CreationTime:    2018-06-14T12:26:46.531613700Z
2a34.29b4:     LastWriteTime:   2018-06-14T12:26:46.534613800Z
2a34.29b4:     ChangeTime:      2023-01-30T09:00:48.943260400Z
2a34.29b4:     FileAttributes:  0x20
2a34.29b4:     Size:            0x196938
2a34.29b4:     NT Headers:      0xe0
2a34.29b4:     Timestamp:       0x5b0cbc1e
2a34.29b4:     Machine:         0x8664 - amd64
2a34.29b4:     Timestamp:       0x5b0cbc1e
2a34.29b4:     Image Version:   6.1
2a34.29b4:     SizeOfImage:     0x19f000 (1699840)
2a34.29b4:     Resource Dir:    0x142000 LB 0x5a038
2a34.29b4:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
2a34.29b4:     [Raw version resource data: 0x1420f0 LB 0x38c, codepage 0x0 (reserved 0x0)]
2a34.29b4:     ProductName:     Microsoft® Windows® Operating System
2a34.29b4:     ProductVersion:  6.1.7601.24150
2a34.29b4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
2a34.29b4:     FileDescription: NT Layer DLL
2a34.29b4: \SystemRoot\System32\kernel32.dll:
2a34.29b4:     CreationTime:    2018-06-14T12:26:46.574616100Z
2a34.29b4:     LastWriteTime:   2018-06-14T12:26:46.577616300Z
2a34.29b4:     ChangeTime:      2023-01-30T09:00:33.536976100Z
2a34.29b4:     FileAttributes:  0x20
2a34.29b4:     Size:            0x11c000
2a34.29b4:     NT Headers:      0xe0
2a34.29b4:     Timestamp:       0x5b0cbc64
2a34.29b4:     Machine:         0x8664 - amd64
2a34.29b4:     Timestamp:       0x5b0cbc64
2a34.29b4:     Image Version:   6.1
2a34.29b4:     SizeOfImage:     0x11f000 (1175552)
2a34.29b4:     Resource Dir:    0x116000 LB 0x530
2a34.29b4:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
2a34.29b4:     [Raw version resource data: 0x1160b0 LB 0x3b0, codepage 0x0 (reserved 0x0)]
2a34.29b4:     ProductName:     Microsoft® Windows® Operating System
2a34.29b4:     ProductVersion:  6.1.7601.24150
2a34.29b4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
2a34.29b4:     FileDescription: Windows NT BASE API Client DLL
2a34.29b4: \SystemRoot\System32\KernelBase.dll:
2a34.29b4:     CreationTime:    2018-06-14T12:26:46.649620400Z
2a34.29b4:     LastWriteTime:   2018-06-14T12:26:46.650620500Z
2a34.29b4:     ChangeTime:      2023-01-30T09:00:33.536976100Z
2a34.29b4:     FileAttributes:  0x20
2a34.29b4:     Size:            0x66800
2a34.29b4:     NT Headers:      0xe8
2a34.29b4:     Timestamp:       0x5b0cbc65
2a34.29b4:     Machine:         0x8664 - amd64
2a34.29b4:     Timestamp:       0x5b0cbc65
2a34.29b4:     Image Version:   6.1
2a34.29b4:     SizeOfImage:     0x6a000 (434176)
2a34.29b4:     Resource Dir:    0x68000 LB 0x538
2a34.29b4:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
2a34.29b4:     [Raw version resource data: 0x680b0 LB 0x3b8, codepage 0x0 (reserved 0x0)]
2a34.29b4:     ProductName:     Microsoft® Windows® Operating System
2a34.29b4:     ProductVersion:  6.1.7601.24150
2a34.29b4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
2a34.29b4:     FileDescription: Windows NT BASE API Client DLL
2a34.29b4: \SystemRoot\System32\apisetschema.dll:
2a34.29b4:     CreationTime:    2018-06-14T12:26:46.541614200Z
2a34.29b4:     LastWriteTime:   2018-06-14T12:26:46.542614300Z
2a34.29b4:     ChangeTime:      2023-01-30T09:00:10.974423400Z
2a34.29b4:     FileAttributes:  0x20
2a34.29b4:     Size:            0x1c00
2a34.29b4:     NT Headers:      0xc0
2a34.29b4:     Timestamp:       0x5b0cbbfe
2a34.29b4:     Machine:         0x8664 - amd64
2a34.29b4:     Timestamp:       0x5b0cbbfe
2a34.29b4:     Image Version:   6.1
2a34.29b4:     SizeOfImage:     0x50000 (327680)
2a34.29b4:     Resource Dir:    0x30000 LB 0x408
2a34.29b4:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
2a34.29b4:     [Raw version resource data: 0x30060 LB 0x3a4, codepage 0x0 (reserved 0x0)]
2a34.29b4:     ProductName:     Microsoft® Windows® Operating System
2a34.29b4:     ProductVersion:  6.1.7601.24150
2a34.29b4:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
2a34.29b4:     FileDescription: ApiSet Schema DLL
2a34.29b4: supR3HardenedWinFindAdversaries: 0x0
2a34.29b4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume10\Programs\WM Box'
2a34.29b4: Calling main()
2a34.29b4: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
2a34.29b4: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume10\Programs\WM Box'
2a34.29b4: '\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe' has no imports
2a34.29b4: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe)
2a34.29b4: SUPR3HardenedMain: Respawn #2
2a34.29b4: supR3HardNtEnableThreadCreationEx:
2a34.29b4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\apphelp.dll)
2a34.29b4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\apphelp.dll
2a34.29b4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
2a34.29b4: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
2a34.29b4: supR3HardenedDllNotificationCallback: load   000007fefc830000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
2a34.29b4: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
2a34.29b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc830000 'C:\Windows\system32\apphelp.dll'
2a34.29b4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076da3740 pvNtTerminateThread=0000000076dc9dd0
2a34.29b4: supR3HardenedWinDoReSpawn(2): New child 1854.30d8 [kernel32].
2a34.29b4: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd8000 cbPeb=0x380
2a34.29b4: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076d60000 uNtDllChildAddr=0000000076d60000
2a34.29b4: supR3HardenedWinSetupChildInit: uLdrInitThunk=0000000076da3740
2a34.29b4: supR3HardenedWinSetupChildInit: Initial context:
  rax=0000000000000000 rbx=0000000000000000 rcx=000000013fb27900 rdx=000007fffffd8000
  rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  r14=0000000000000000 r15=0000000000000000  P1=0000000000000000  P2=0000000000000000
  rip=0000000076db3820 rsp=00000000002cf828 rbp=0000000000000000    ctxflags=0010001b
  cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000    eflags=00000200   mxcrx=00001f80
   P3=0000000000000000  P4=0000000000000000  P5=0000000000000000  P6=0000000000000000
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
2a34.29b4: kernel32.dll: timestamp 0x5b0cbc64 (rc=VINF_SUCCESS)
2a34.29b4: supR3HardenedWinSetupChildInit: Start child.
2a34.29b4: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
2a34.29b4: supR3HardNtChildPurify: Startup delay kludge #1/0: 264 ms, 33 sleeps
2a34.29b4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
2a34.29b4:  *0000000000000000-000000000000ffff 0x0001/0x0000 0x0000000
2a34.29b4:  *0000000000010000-000000000002ffff 0x0004/0x0004 0x0020000
2a34.29b4:  *0000000000030000-0000000000033fff 0x0002/0x0002 0x0040000
2a34.29b4:   0000000000034000-000000000003ffff 0x0001/0x0000 0x0000000
2a34.29b4:  *0000000000040000-0000000000040fff 0x0004/0x0004 0x0020000
2a34.29b4:   0000000000041000-00000000001cffff 0x0001/0x0000 0x0000000
2a34.29b4:  *00000000001d0000-00000000002cbfff 0x0000/0x0004 0x0020000
2a34.29b4:   00000000002cc000-00000000002cdfff 0x0104/0x0004 0x0020000
2a34.29b4:   00000000002ce000-00000000002cffff 0x0004/0x0004 0x0020000
2a34.29b4:   00000000002d0000-0000000076d5ffff 0x0001/0x0000 0x0000000
2a34.29b4:  *0000000076d60000-0000000076d60fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076d61000-0000000076e84fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076e85000-0000000076e8afff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076e8b000-0000000076e8bfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076e8c000-0000000076e93fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076e94000-0000000076efefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\ntdll.dll
2a34.29b4:   0000000076eff000-000000007efdffff 0x0001/0x0000 0x0000000
2a34.29b4:  *000000007efe0000-000000007ffdffff 0x0000/0x0002 0x0020000
2a34.29b4:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
2a34.29b4:   000000007ffe1000-000000007ffeffff 0x0000/0x0002 0x0020000
2a34.29b4:   000000007fff0000-000000013fb1ffff 0x0001/0x0000 0x0000000
2a34.29b4:  *000000013fb20000-000000013fb20fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fb21000-000000013fb96fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fb97000-000000013fb97fff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fb98000-000000013fbdffff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe0000-000000013fbe0fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe1000-000000013fbe1fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe2000-000000013fbe6fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe7000-000000013fbe7fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe8000-000000013fbe8fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbe9000-000000013fbecfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fbed000-000000013fc35fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe
2a34.29b4:   000000013fc36000-000007feff05ffff 0x0001/0x0000 0x0000000
2a34.29b4:  *000007feff060000-000007feff060fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume1\Windows\System32\apisetschema.dll
2a34.29b4:   000007feff061000-000007fffffaffff 0x0001/0x0000 0x0000000
2a34.29b4:  *000007fffffb0000-000007fffffd2fff 0x0002/0x0002 0x0040000
2a34.29b4:   000007fffffd3000-000007fffffd7fff 0x0001/0x0000 0x0000000
2a34.29b4:  *000007fffffd8000-000007fffffd8fff 0x0004/0x0004 0x0020000
2a34.29b4:   000007fffffd9000-000007fffffddfff 0x0001/0x0000 0x0000000
2a34.29b4:  *000007fffffde000-000007fffffdffff 0x0004/0x0004 0x0020000
2a34.29b4:  *000007fffffe0000-000007fffffeffff 0x0001/0x0002 0x0020000
2a34.29b4: apisetschema.dll: timestamp 0x5b0cbbfe (rc=VINF_SUCCESS)
2a34.29b4: VirtualBoxVM.exe: timestamp 0x5ebd9c8a (rc=VINF_SUCCESS)
2a34.29b4: '\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe' has no imports
2a34.29b4: '\Device\HarddiskVolume1\Windows\System32\apisetschema.dll' has no imports
2a34.29b4: '\Device\HarddiskVolume1\Windows\System32\ntdll.dll' has no imports
2a34.29b4: supR3HardNtChildPurify: Done after 387 ms and 0 fixes (loop #0).
1854.30d8: Log file opened: 6.1.8r137981 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
2a34.29b4: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000320000 LB 0x400000)
1854.30d8: supR3HardenedVmProcessInit: uNtDllAddr=0000000076d60000 g_uNtVerCombined=0x611db100 (stack ~00000000002cf2d8)
2a34.29b4: supR3HardNtEnableThreadCreationEx:
1854.30d8: ntdll.dll: timestamp 0x5b0cbc1e (rc=VINF_SUCCESS)
1854.30d8: New simple heap: #1 00000000002d0000 LB 0x400000 (for 1699840 allocation)
1854.30d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume10\Programs\WM Box'
1854.30d8: System32:  \Device\HarddiskVolume1\Windows\System32
1854.30d8: WinSxS:    \Device\HarddiskVolume1\Windows\winsxs
1854.30d8: KnownDllPath: C:\Windows\system32
1854.30d8: supR3HardenedVmProcessInit: Opening vboxdrv...
1854.30d8: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
1854.30d8: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
1854.30d8: Registered Dll notification callback with NTDLL.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\kernel32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\kernel32.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   0000000076c40000 LB 0x0011f000 C:\Windows\system32\kernel32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcd80000 LB 0x0006a000 C:\Windows\system32\KERNELBASE.dll [fFlags=0x0]
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\KernelBase.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\KernelBase.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076c40000 'C:\Windows\system32\kernel32.dll'
1854.30d8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=0000000076da3740 pvNtTerminateThread=0000000076dc9dd0
2a34.29b4: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 64 ms.
1854.30d8: \SystemRoot\System32\ntdll.dll:
1854.30d8:     CreationTime:    2018-06-14T12:26:46.531613700Z
1854.30d8:     LastWriteTime:   2018-06-14T12:26:46.534613800Z
1854.30d8:     ChangeTime:      2023-01-30T09:00:48.943260400Z
1854.30d8:     FileAttributes:  0x20
1854.30d8:     Size:            0x196938
1854.30d8:     NT Headers:      0xe0
1854.30d8:     Timestamp:       0x5b0cbc1e
1854.30d8:     Machine:         0x8664 - amd64
1854.30d8:     Timestamp:       0x5b0cbc1e
1854.30d8:     Image Version:   6.1
1854.30d8:     SizeOfImage:     0x19f000 (1699840)
1854.30d8:     Resource Dir:    0x142000 LB 0x5a038
1854.30d8:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
1854.30d8:     [Raw version resource data: 0x1420f0 LB 0x38c, codepage 0x0 (reserved 0x0)]
1854.30d8:     ProductName:     Microsoft® Windows® Operating System
1854.30d8:     ProductVersion:  6.1.7601.24150
1854.30d8:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
1854.30d8:     FileDescription: NT Layer DLL
1854.30d8: \SystemRoot\System32\kernel32.dll:
1854.30d8:     CreationTime:    2018-06-14T12:26:46.574616100Z
1854.30d8:     LastWriteTime:   2018-06-14T12:26:46.577616300Z
1854.30d8:     ChangeTime:      2023-01-30T09:00:33.536976100Z
1854.30d8:     FileAttributes:  0x20
1854.30d8:     Size:            0x11c000
1854.30d8:     NT Headers:      0xe0
1854.30d8:     Timestamp:       0x5b0cbc64
1854.30d8:     Machine:         0x8664 - amd64
1854.30d8:     Timestamp:       0x5b0cbc64
1854.30d8:     Image Version:   6.1
1854.30d8:     SizeOfImage:     0x11f000 (1175552)
1854.30d8:     Resource Dir:    0x116000 LB 0x530
1854.30d8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
1854.30d8:     [Raw version resource data: 0x1160b0 LB 0x3b0, codepage 0x0 (reserved 0x0)]
1854.30d8:     ProductName:     Microsoft® Windows® Operating System
1854.30d8:     ProductVersion:  6.1.7601.24150
1854.30d8:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
1854.30d8:     FileDescription: Windows NT BASE API Client DLL
1854.30d8: \SystemRoot\System32\KernelBase.dll:
1854.30d8:     CreationTime:    2018-06-14T12:26:46.649620400Z
1854.30d8:     LastWriteTime:   2018-06-14T12:26:46.650620500Z
1854.30d8:     ChangeTime:      2023-01-30T09:00:33.536976100Z
1854.30d8:     FileAttributes:  0x20
1854.30d8:     Size:            0x66800
1854.30d8:     NT Headers:      0xe8
1854.30d8:     Timestamp:       0x5b0cbc65
1854.30d8:     Machine:         0x8664 - amd64
1854.30d8:     Timestamp:       0x5b0cbc65
1854.30d8:     Image Version:   6.1
1854.30d8:     SizeOfImage:     0x6a000 (434176)
1854.30d8:     Resource Dir:    0x68000 LB 0x538
1854.30d8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
1854.30d8:     [Raw version resource data: 0x680b0 LB 0x3b8, codepage 0x0 (reserved 0x0)]
1854.30d8:     ProductName:     Microsoft® Windows® Operating System
1854.30d8:     ProductVersion:  6.1.7601.24150
1854.30d8:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
1854.30d8:     FileDescription: Windows NT BASE API Client DLL
1854.30d8: \SystemRoot\System32\apisetschema.dll:
1854.30d8:     CreationTime:    2018-06-14T12:26:46.541614200Z
1854.30d8:     LastWriteTime:   2018-06-14T12:26:46.542614300Z
1854.30d8:     ChangeTime:      2023-01-30T09:00:10.974423400Z
1854.30d8:     FileAttributes:  0x20
1854.30d8:     Size:            0x1c00
1854.30d8:     NT Headers:      0xc0
1854.30d8:     Timestamp:       0x5b0cbbfe
1854.30d8:     Machine:         0x8664 - amd64
1854.30d8:     Timestamp:       0x5b0cbbfe
1854.30d8:     Image Version:   6.1
1854.30d8:     SizeOfImage:     0x50000 (327680)
1854.30d8:     Resource Dir:    0x30000 LB 0x408
1854.30d8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
1854.30d8:     [Raw version resource data: 0x30060 LB 0x3a4, codepage 0x0 (reserved 0x0)]
1854.30d8:     ProductName:     Microsoft® Windows® Operating System
1854.30d8:     ProductVersion:  6.1.7601.24150
1854.30d8:     FileVersion:     6.1.7601.24150 (win7sp1_ldr_escrow.180528-1700)
1854.30d8:     FileDescription: ApiSet Schema DLL
1854.30d8: supR3HardenedWinFindAdversaries: 0x0
1854.30d8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume10\Programs\WM Box'
1854.30d8: Calling main()
1854.30d8: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
1854.30d8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume10\Programs\WM Box'
1854.30d8: '\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe' has no imports
1854.30d8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.exe)
1854.30d8: SUPR3HardenedMain: Final process, opening VBoxDrv...
1854.30d8: supR3HardenedEarlyCompact: Removed heap 1 (0x000000002d0000 LB 0x400000)
1854.30d8: supR3HardNtEnableThreadCreationEx:
1854.30d8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cb161:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fef7200000 LB 0x00005000 E:\Programs\WM Box\VBoxSupLib.DLL [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c88e1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef7200000 'E:\Programs\WM Box\VBoxSupLib.DLL'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202 (0x5e8a)) on \Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c88e1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef7200000 'E:\Programs\WM Box\VBoxSupLib.DLL'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef7200000 'E:\Programs\WM Box\VBoxSupLib.DLL'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'crypt32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\wintrust.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\wintrust.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume1\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\msasn1.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\msasn1.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume1\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msasn1.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\crypt32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\crypt32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\msvcrt.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\msvcrt.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume1\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002ccf71:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcbd0000 LB 0x0003b000 C:\Windows\system32\Wintrust.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe6f0000 LB 0x0009f000 C:\Windows\system32\msvcrt.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefca60000 LB 0x0016d000 C:\Windows\system32\CRYPT32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefca40000 LB 0x0000f000 C:\Windows\system32\MSASN1.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcef0000 LB 0x0012d000 C:\Windows\system32\RPCRT4.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbd0000 'C:\Windows\system32\Wintrust.dll'
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\bcrypt.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\bcrypt.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002ccf71:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefc300000 LB 0x00022000 C:\Windows\system32\bcrypt.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc300000 'C:\Windows\system32\bcrypt.dll'
1854.30d8: bcrypt.dll loaded at 000007fefc300000, BCryptOpenAlgorithmProvider at 000007fefc302460, preloading providers:
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'bcrypt.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\bcryptprimitives.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\bcryptprimitives.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume1\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\advapi32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\advapi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002ccf51:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefbdf0000 LB 0x0004c000 C:\Windows\system32\bcryptprimitives.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe790000 LB 0x000db000 C:\Windows\system32\ADVAPI32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\sechost.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\sechost.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefed00000 LB 0x0001f000 C:\Windows\SYSTEM32\sechost.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\sechost.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbdf0000 'C:\Windows\system32\bcryptprimitives.dll'
1854.30d8:     BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=00000000008ebbb0)
1854.30d8:     BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=00000000008ec450)
1854.30d8:     BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=00000000008ec580)
1854.30d8:     BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=00000000008ec7a0)
1854.30d8:     BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=00000000008ec8d0)
1854.30d8:     BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=00000000008eca00)
1854.30d8:     BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=00000000008ecc50)
1854.30d8:     BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=00000000008ecd80)
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\cryptsp.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\cryptsp.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002ccac1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefc1b0000 LB 0x00018000 C:\Windows\system32\CRYPTSP.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc1b0000 'C:\Windows\system32\CRYPTSP.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\rsaenh.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\rsaenh.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cca51:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefbeb0000 LB 0x00047000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbeb0000 'C:\Windows\system32\rsaenh.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc2e1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe790000 'C:\Windows\system32\ADVAPI32.dll'
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\cryptbase.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\cryptbase.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc661:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefc8d0000 LB 0x0000f000 C:\Windows\system32\CRYPTBASE.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc8d0000 'C:\Windows\system32\CRYPTBASE.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc091:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076c40000 'C:\Windows\system32\kernel32.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cca21:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbd0000 'C:\Windows\system32\WINTRUST.DLL'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002cc851:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefca60000 'C:\Windows\system32\CRYPT32.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'advapi32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\imagehlp.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\imagehlp.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\imagehlp.dll (Input=imagehlp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc8a1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe5b0000 LB 0x00019000 C:\Windows\system32\imagehlp.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\imagehlp.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe5b0000 'C:\Windows\system32\imagehlp.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTSP.dll (Input=CRYPTSP.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc9f1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc1b0000 'C:\Windows\system32\CRYPTSP.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\user32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\user32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'lpk.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\gdi32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\gdi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'lpk.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'lpk.dll' -> '\Device\HarddiskVolume1\Windows\System32\lpk.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'usp10.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\lpk.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\lpk.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'usp10.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'usp10.dll' -> '\Device\HarddiskVolume1\Windows\System32\usp10.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\usp10.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\usp10.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USER32.dll (Input=USER32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc521:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   0000000076b40000 LB 0x000fa000 C:\Windows\system32\USER32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd230000 LB 0x00067000 C:\Windows\system32\GDI32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd2a0000 LB 0x0000e000 C:\Windows\system32\LPK.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\lpk.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe870000 LB 0x000cb000 C:\Windows\system32\USP10.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\usp10.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\gdi32.dll (Input=gdi32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cba21:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd230000 'C:\Windows\system32\gdi32.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msctf.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\imm32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\imm32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msctf.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msctf.dll' -> '\Device\HarddiskVolume1\Windows\System32\msctf.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'imm32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\msctf.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\msctf.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume1\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\imm32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cb361:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\imm32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd200000 LB 0x0002e000 C:\Windows\system32\IMM32.DLL [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\imm32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd490000 LB 0x00109000 C:\Windows\system32\MSCTF.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msctf.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd200000 'C:\Windows\system32\IMM32.DLL'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=0000000076b40000 'C:\Windows\system32\USER32.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'bcrypt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msasn1.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\ncrypt.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\ncrypt.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msasn1.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' -> '\Device\HarddiskVolume1\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume1\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ncrypt.dll (Input=ncrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc821:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefc360000 LB 0x00050000 C:\Windows\system32\ncrypt.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\ncrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc360000 'C:\Windows\system32\ncrypt.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (Input=bcrypt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc611:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefc300000 'C:\Windows\system32\bcrypt.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'profapi.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\userenv.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\userenv.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'profapi.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' -> '\Device\HarddiskVolume1\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\profapi.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\profapi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\USERENV.dll (Input=USERENV.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cbfa1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\userenv.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefccf0000 LB 0x0001f000 C:\Windows\system32\USERENV.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\userenv.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefca30000 LB 0x0000f000 C:\Windows\system32\profapi.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\profapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefccf0000 'C:\Windows\system32\USERENV.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbd01:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cc091:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\gpapi.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\gpapi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\GPAPI.dll (Input=GPAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc2c1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefbc70000 LB 0x0001b000 C:\Windows\system32\GPAPI.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbc70000 'C:\Windows\system32\GPAPI.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cc211:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-WIN-Service-Management-L1-1-0.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cb911:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcef0000 'C:\Windows\system32\rpcrt4.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cc1f1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-WIN-Service-Management-L2-1-0.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cc201:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'crypt32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'wldap32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\cryptnet.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\cryptnet.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldap32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldap32.dll' -> '\Device\HarddiskVolume1\Windows\System32\wldap32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\Wldap32.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\Wldap32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume1\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cbd01:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fef5910000 LB 0x00027000 C:\Windows\system32\cryptnet.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcdf0000 LB 0x00052000 C:\Windows\system32\WLDAP32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\Wldap32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=00000000002caf31:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fef5910000 'C:\Windows\system32\cryptnet.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cb621:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\profapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\profapi.dll (Input=profapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cb621:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefca30000 'C:\Windows\system32\profapi.dll'
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcrt.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\shlwapi.dll)
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\shlwapi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\user32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHLWAPI.dll (Input=SHLWAPI.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cb0b1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe5d0000 LB 0x00071000 C:\Windows\system32\SHLWAPI.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\shlwapi.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe5d0000 'C:\Windows\system32\SHLWAPI.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1A42AD81F8E2D9814C46F71302EB9D497B9D440D
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-SDDL-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbfe1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-SDDL-L1-1-0.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-Management-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbb41:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-WIN-Service-Management-L1-1-0.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-Service-winsvc-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbb41:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-WIN-Service-winsvc-L1-1-0.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll [lacks WinVerifyTrust]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ADVAPI32.dll (Input=ADVAPI32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cbfe1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefe790000 'C:\Windows\system32\ADVAPI32.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbf91:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
1854.30d8: supR3HardenedIsApiSetDll: '<NULL>' -> true
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Security-LSALookup-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=00000000002cbc81:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefed00000 'API-MS-Win-Security-LSALookup-L1-1-0.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\SystemRoot\System32\ntdll.dll'
1854.30d8: g_pfnWinVerifyTrust=000007fefcbd1010
1854.30d8: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000c4 pwszName=\Device\HarddiskVolume1\Windows\System32\crypt32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=03C3949C543BC88555B566D6E3CD5F1E43072E83
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\crypt32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\crypt32.dll'
1854.30d8: supR3HardenedScreenImage/preload: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000b8 pwszName=\Device\HarddiskVolume1\Windows\System32\wintrust.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=94B4C88ADC72C33C3A3D87A716B5557571C2B9F2
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\wintrust.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedScreenImage/preload: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\wintrust.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000378 pwszName=\Device\HarddiskVolume1\Windows\System32\shlwapi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=075C186B9EBBDEFAE43835198B8FA4897C63C80A
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\shlwapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\shlwapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000036c pwszName=\Device\HarddiskVolume1\Windows\System32\Wldap32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=086A94704E162AB5C6F0ED4BA6DE6C8B4524BA56
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\Wldap32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\Wldap32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000368 pwszName=\Device\HarddiskVolume1\Windows\System32\cryptnet.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6AFF13995E2E993955E220EA5853B61404FCBF42
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\cryptnet.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\cryptnet.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000244 pwszName=\Device\HarddiskVolume1\Windows\System32\gpapi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=EBDAA16C3FD93DFF9C20BA3B2689DFF4C8D31061
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_115_for_KB3159398~31bf3856ad364e35~amd64~~6.1.1.1.cat'; file='\Device\HarddiskVolume1\Windows\System32\gpapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\gpapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001b0 pwszName=\Device\HarddiskVolume1\Windows\System32\profapi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2449672745D9BA339420451D13FA0380AA768231
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume1\Windows\System32\profapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\profapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000001ac pwszName=\Device\HarddiskVolume1\Windows\System32\userenv.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4D9F8AE55E46F7953AA1EFA379D76F2A76D6983B
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\userenv.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\userenv.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000198 pwszName=\Device\HarddiskVolume1\Windows\System32\ncrypt.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6DAF8ACE42E9E77E0A6CD5AC74CE973EF1536995
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\ncrypt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\ncrypt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000017c pwszName=\Device\HarddiskVolume1\Windows\System32\msctf.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B18074E6500B26B9675D6739EF0E6FFC56E8E0CA
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\msctf.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\msctf.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000178 pwszName=\Device\HarddiskVolume1\Windows\System32\imm32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C0711589B5C71949BF83C0050BD6CCD5C563CB82
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\imm32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\imm32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000174 pwszName=\Device\HarddiskVolume1\Windows\System32\usp10.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8AE1E4C5A6AE2CD7C2699FE89EFC72F3203BC58E
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\usp10.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\usp10.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000170 pwszName=\Device\HarddiskVolume1\Windows\System32\lpk.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7BFDF7621B61897A8F8E618E72DA3FE013EE97F9
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\lpk.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\lpk.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000016c pwszName=\Device\HarddiskVolume1\Windows\System32\gdi32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2D767C07C15EAAFC316567AB2F5CA7B85CCD70E2
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\gdi32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\gdi32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000168 pwszName=\Device\HarddiskVolume1\Windows\System32\user32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=03BB259EC2F9D61B0941E0635513FFA135E07009
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\user32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\user32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000164 pwszName=\Device\HarddiskVolume1\Windows\System32\imagehlp.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4196077E577B8C9A37A0393FF352B04A96D1BD25
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\imagehlp.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\imagehlp.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000118 pwszName=\Device\HarddiskVolume1\Windows\System32\cryptbase.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=735A47E9294FFFCED23F327BE677B9C135337E03
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\cryptbase.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\cryptbase.dll'
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\rsaenh.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000114 pwszName=\Device\HarddiskVolume1\Windows\System32\cryptsp.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CECCA98E04985A576883E9A9AD8AF2140526B576
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\cryptsp.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\cryptsp.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000104 pwszName=\Device\HarddiskVolume1\Windows\System32\sechost.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9417957BEBAB30D0967EBB53DB5B3602DF9D0DA0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\sechost.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\sechost.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000100 pwszName=\Device\HarddiskVolume1\Windows\System32\advapi32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CD323C9D280CE8D84C72D561E30BA06F96428DBB
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\advapi32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\advapi32.dll'
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\bcryptprimitives.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000e8 pwszName=\Device\HarddiskVolume1\Windows\System32\bcrypt.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1A28E0593EBCB03C595EC9583C4FAFE42C7623B8
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\bcrypt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\bcrypt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000c8 pwszName=\Device\HarddiskVolume1\Windows\System32\msvcrt.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F543D9693ED83595BA3E87097E428D8B06956700
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\msvcrt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000c0 pwszName=\Device\HarddiskVolume1\Windows\System32\msasn1.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=71CB8510727C0FFA0BCEEFFACE63ACD80E6D9E25
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\msasn1.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\msasn1.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000000bc pwszName=\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=91E68718185CD9685559A8AD1D9AFD3CAB2C537C
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll'
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume10\Programs\WM Box\VBoxSupLib.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000028 pwszName=\Device\HarddiskVolume1\Windows\System32\KernelBase.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FA747CC54D0E369B762123058F42317119AB5F6D
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\KernelBase.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\KernelBase.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000020 pwszName=\Device\HarddiskVolume1\Windows\System32\kernel32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C1F8DF1081428580D816D247251F5FA873ED8A86
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\kernel32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume1\Windows\System32\kernel32.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cba81:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefca60000 'C:\Windows\system32\crypt32.dll'
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x39bb496d7f0fc200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Development Root Certificate Authority 2014
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x100089abfea8e300 C=DE, ST=Bavaria, L=Munich, O=Oracle Deutschland B.V. & Co. KG, CN=VirtualBox for Legacy Windows Only Timestamp CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe0249b57ec7fbc00 C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication EV RootCA1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4a25c87eb933b700 C=RO, O=certSIGN, OU=certSIGN ROOT CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3703c8da1585b000 C=FI, ST=Finland, O=Vaestorekisterikeskus CA, OU=Certification Authority Services, OU=Varmennepalvelut, CN=VRK Gov. Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x8b062bb556fcc300 C=FR, O=Certeurope, OU=0002 434202180, CN=Certeurope Root CA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x977025a7d23db100 C=UY, O=ADMINISTRACION NACIONAL DE CORREOS, OU=SERVICIOS ELECTRONICOS, CN=Correo Uruguayo - Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x15941d5f68b5c600 CN=ComSign Secured CA, O=ComSign, C=IL
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa12b07674f1bf600 C=US, O=AffirmTrust, CN=AffirmTrust Commercial
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x57b18dfb583fb8cd C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x75a2ccecb8259a00 C=TW, O=Government Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x2ca429a5c4c6a700 C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd8dbfb2c27bfb200 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4701de45a311b800 C=NL, O=Digidentity B.V., CN=Digidentity L3 Root CA - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd66525adaaa600 C=JP, O=Japanese Government, OU=GPKI, CN=ApplicationCA2 Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x91e3728b8b40d000 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xeb7a1ac4eef2cd00 C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Platina (Class Platinum) Főtanúsítvány
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x788c2b5ac673bf00 C=CN, O=CFCA GT CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x57ea572f1df7c400 C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root EV CA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe0c6a3a05515a600 C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x1f3f10cd6b5dd700 C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc7d32b6954e4f000 CN=ComSign CA, O=ComSign, C=IL
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x760668e19592ff00 CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x50bb81640c01cb00 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xaafa7abb99ab000 O=Cisco Systems, CN=Cisco Root CA 2048
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xbbde687390e6bf00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb798ed29328b700 CN=Autoridad de Certificacion Raiz del Estado Venezolano, C=VE, L=Caracas, ST=Distrito Capital, O=Sistema Nacional de Certificacion Electronica, OU=Superintendencia de Servicios de Certificacion Electronica, Email=acraiz@suscerte.gob.ve
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x38b3b5303d1acd00 C=GR, O=Athens Exchange S.A., CN=ATHEX Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe35016950adaa500 C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe248b7eeee4af00 C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x41fe5fa9df12c400 C=US, O=AffirmTrust, CN=AffirmTrust Premium
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x266e9b638ffac00 C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xafc0be88bdf2a800 DC=rs, DC=posta, DC=ca, CN=Configuration, CN=Services, CN=Public Key Services, CN=AIA, CN=Posta CA Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3931598f2f47ac00 C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc6536f24d57ae723 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x48cc53a3896bab00 C=CO, O=Sociedad Cameral de Certificación Digital - Certicámara S.A., CN=AC Raíz Certicámara S.A.
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd71519e43fd5ba00 C=CA, ST=Ontario, L=Toronto, O=Echoworx Corporation, OU=Certification Services, CN=Echoworx Root CA2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xade42733bd8d9700 C=us, O=U.S. Government, OU=FBCA, CN=Common Policy
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3714f47324e8ad00 C=US, O=Internet Security Research Group, CN=ISRG Root X1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd944bca189a00 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4bc5e0ecc020c800 C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, Email=pki@sk.ee
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe0b0c3006b04c400 C=LV, OU=Sertifikacijas pakalpojumu dala, CN=E-ME SSI (RCA)
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x73c1ebd2e9958f00 C=LT, O=Skaitmeninio sertifikavimo centras, OU=CA ROOT Services, CN=SSC GDL CA Root B
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x22c0bfed122ca900 C=CH, O=The Federal Authorities of the Swiss Confederation, OU=Services, OU=Certification Authorities, CN=Swiss Government Root CA II
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x292d67d00f91f000 C=ES, O=Agencia Notarial de Certificacion S.L. Unipersonal - CIF B83395988, CN=ANCERT Certificados Notariales
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xea33d3c14ab5d900 C=DE, ST=Baden-Wuerttemberg (BW), L=Stuttgart, O=Deutscher Sparkassen Verlag GmbH, CN=S-TRUST Authentication and Encryption Root CA 2005:PN
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x1591b8ac8dcabd00 C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x6e864c7a8071ba00 C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x923c3ab73579a1d0 C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xbab415bd1e249800 C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x85d60900c4a3a200 C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x20a3c30cad008000 C=ES, O=DIRECCION GENERAL DE LA POLICIA, OU=DNIE, CN=AC RAIZ DNIE
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb5e231b8cb64a900 C=PL, O=Telekomunikacja Polska S.A., OU=Signet Certification Authority, CN=Signet Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf7c33b7ebfec9b00 C=SI, O=POSTA, OU=POSTArCA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb3d6d6c9f168c800 C=FR, O=Dhimyotis, CN=Certigna
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xfbf8ea8e6b96ca00 C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xeb1d2a732928b200 CN=ComSign Global Root CA, O=ComSign Ltd., C=IL
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xbf168afe877852f1 C=US, O=thawte, Inc., OU=(c) 2007 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x40e7dd0ea446ba00 C=BR, O=ICP-Brasil, OU=Instituto Nacional de Tecnologia da Informacao - ITI, CN=Autoridade Certificadora Raiz Brasileira v2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x449f1b13efa09400 C=CH, O=SwissSign AG, CN=SwissSign Platinum Root CA - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x862f01f4720ec800 C=CH, O=The Federal Authorities of the Swiss Confederation, OU=Services, OU=Certification Authorities, CN=Swiss Government Root CA I
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x363f522f28e7d900 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xda5f1cc8fc5ca000 C=CZ, O=Česká pošta, s.p. [IČ 47114983], CN=PostSignum Root QCA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd41691e475fb8515 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x923f2c0a09ccd400 C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc48cebc8db05b000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3178d37f87f1c400 C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf4eb5e1975b7c500 C=my, O=TM, OU=TM Applied Business Certification Authority, CN=TM Applied Business Root Certificate
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x87b3c722f299c800 C=LT, O=VI Registru Centras - I.k. 124110246, OU=Registru Centro Sertifikavimo Centras, CN=VI Registru Centras RCSC (RootCA)
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x2fba703484f19900 C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x974a61bfaba99b00 CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4ef92ac43a0cd500 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xebbf1d700c008a00 C=US, O=Verizon Business, OU=OmniRoot, CN=Verizon Global Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa398dcf778c3aa00 C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xef62113787ebace5 C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x7c71e6059b87be00 C=CH, O=SwissSign AG, CN=SwissSign Silver Root CA - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xad77733ff735d300 C=CN, O=CNNIC, CN=CNNIC ROOT
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xdaad63f38ff8e900 C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, Email=info@e-szigno.hu
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US, O=SecureTrust Corporation, CN=SecureTrust CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xabd0695c5d11d15e C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3b756388ea46ee60 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 1 Public Primary Certification Authority - G4
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x96af0ce22ce4e300 C=SA, O=National Center for Digital Certification, OU=Saudi National Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x7d2686ca075db300 C=CN, O=UniTrust, CN=UCA Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x5784013b5c9c9d00 CN=ComSign Advanced Security CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x5c39bb51bbe0b400 C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Class 3 CA, CN=TC TrustCenter Class 3 CA II
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x23f085ee57b2b400 C=ES, O=Consejo General de la Abogacia NIF:Q-2863006I, CN=Autoridad de Certificacion de la Abogacia
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x831827e970529d00 C=ES, O=Agencia Notarial de Certificacion S.L.U. - CIF B83395988, CN=ANCERT Certificados CGN V2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xbebef0d2217f0bfb C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x81a1442a1fc49700 CN=Autoridad Certificadora Raíz Nacional de Uruguay, O=AGESIC, C=UY
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x802b3770cb00af00 C=EU, L=Madrid (see current address at www.camerfirma.com/address), SRN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe6519d844e429500 C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc9b005046ffea100 C=KR, O=Government of Korea, OU=GPKI, CN=GPKIRootCA1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc66d30927ebce400 C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x2a6a1dc6b9e6b200 C=ES, O=Agencia Notarial de Certificacion S.L.U. - CIF B83395988, CN=ANCERT Certificados Notariales V2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x185da5e55536b700 C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa4031c19392e9f0e OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x88db8dee0f25e100 C=TW, O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xfaccd3ef7cba514a C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 2 Public Primary Certification Authority - G4
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xdb2cd5c20d0aaf00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb352b1523915d000 C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xbbd90ca8b0b9d000 C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x5153f7daa1499900 C=DK, O=TRUST2408, CN=TRUST2408 OCES Primary CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x328ccb712f3ec700 C=ES, ST=Barcelona, L=Barcelona (see current address at http://www.anf.es/es/address-direccion.html ), O=ANF Autoridad de Certificacion, OU=ANF Clase 1 CA, Email=info@anf.es, SRN=G63287510, CN=ANF Global Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x19c084be4feaba00 C=LT, O=Skaitmeninio sertifikavimo centras, OU=Certification Authority, CN=SSC Root CA A
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x92d01fe10011c900 C=US, O=VISA, OU=Visa International Service Association, CN=Visa Information Delivery Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x363d9b00b34fcb00 C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x73e85f1bda5faa00 C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xef477acf4ab2d300 C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc672382f6ee021a1 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Public Primary Certification Authority - G4
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa8aca89ee6edc000 C=SE, O=Inera AB, CN=SITHS Root CA v1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf8dae202a2dfca00 C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2262f09375bd00 C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x75f4feca85b98900 C=SI, O=Halcom, CN=Halcom Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x1e5105933ff5e200 C=TR, L=Ankara, O=E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x99a96449d739c700 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 1 Public Primary Certification Authority - G6
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x783bbdee737e9b00 C=CN, O=China Internet Network Information Center, CN=China Internet Network Information Center EV Certificates Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe87add30c52db600 C=BE, O=GlobalSign nv-sa, CN=GlobalSign Code Signing Root R45
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x615eae439978de00 C=US, ST=MN, L=Minneapolis, O=Open Access Technology International Inc, CN=OATI WebCARES Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x9b3ae4d356dfc000 C=EU, L=Madrid (see current address at www.camerfirma.com/address), SRN=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd407c1f75ec7d700 C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xea8e67100ecbb300 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe05fe608c95b000 C=IL, O=PersonalID Ltd., OU=Certificate Services, CN=PersonalID Trustworthy RootCA 2011
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa321f027ebbec200 O=TeliaSonera, CN=TeliaSonera Root CA v1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x8563c805e9cccd00 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 2 Public Primary Certification Authority - G6
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4e5147f555f3c100 C=LT, O=Skaitmeninio sertifikavimo centras, OU=Certification Authority, CN=SSC Root CA B
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x5901ca5aa77fd00 C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA11
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xd0353b9e7b50c500 C=GB, O=Trustis Limited, OU=Trustis FPS Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x556cacd82e35af00 C=US, O=SecureTrust Corporation, CN=Secure Global CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x99f15213ef3bc100 CN=Autoridad de Certificacion Raiz del Estado Venezolano, C=VE, L=Caracas, ST=Distrito Capital, O=Sistema Nacional de Certificacion Electronica, OU=Superintendencia de Servicios de Certificacion Electronica, Email=acraiz@suscerte.gob.ve
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x30669a4e82fa800 C=US, O=America Online Inc., CN=America Online Root Certification Authority 1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa9c86e43a2efdb00 C=PT, O=SCEE, CN=ECRaizEstado
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf23ec9c15254b300 C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x7052e7f4a064c100 L=Alvaro Obregon, ST=Distrito Federal, C=MX, ZIP=01030, street=Insurgentes Sur 1940, CN=Autoridad Certificadora Raiz de la Secretaria de Economia, OU=Direccion General de Normatividad Mercantil, O=Secretaria de Economia, Email=acrse@economia.gob.mx
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe8985fec4712d200 C=AT, L=Vienna, ST=Austria, O=ARGE DATEN - Austrian Society for Data Protection, OU=GLOBALTRUST Certification Service, CN=GLOBALTRUST, Email=info@globaltrust.info
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xae429fd0a270a200 C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x1e150ab191dca400 C=ZA, O=LAWtrust, OU=LAW Trusted Third Party Services PTY Ltd., CN=LAWtrust Root Certification Authority 2048
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x7cd4ff7b15b8be00 C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x20b7075b3689b600 C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xac1e0fca7ad3c900 C=ES, O=IZENPE S.A., CN=Izenpe.com
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xafe3d3869f859d00 C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Autorité Racine
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x3b2a6f973b859500 CN=Atos TrustedRoot 2011, O=Atos, C=DE
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x6b2e1733cc84b400 C=US, O=AffirmTrust, CN=AffirmTrust Networking
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x4297e24fc722b300 C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x9abc4dfab20eb700 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Public Primary Certification Authority - G6
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa9cc8cfa2245a100 C=LT, O=Skaitmeninio sertifikavimo centras, OU=Certification Authority, CN=SSC Root CA C
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x92ac5ed85c2d0e9b C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2007 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G4
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb8ce920e1b50ac00 C=ES, O=Colegio de Registradores de la Propiedad y Mercantiles de España, OU=Certificado Propio, CN=Registradores de España - CA Raíz
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x665f55ebd06ce27b C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xa7f9b4b9d484dd00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xe69c54164257cc00 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xb9ff821d139e9bf OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e98e1050bea000 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x9830119f287caa00 C=FR, O=ANSSI, OU=0002 130007669, CN=IGC/A AC racine Etat francais
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x87fc251e2149d000 C=CN, O=WoSign CA Limited, CN=CA 沃通根证书
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xcaac0c3f3f759000 C=ES, O=Agencia Notarial de Certificacion S.L. Unipersonal - CIF B83395988, CN=ANCERT Certificados CGN
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xeb8adc879521a200 C=ES, O=Agencia Notarial de Certificacion S.L. Unipersonal - CIF B83395988, CN=ANCERT Corporaciones de Derecho Publico
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf63f5006e5b3da00 C=CN, O=UniTrust, CN=UCA Global Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x9d5a65c89fe8c300 C=CH, O=SwissSign AG, CN=SwissSign Gold Root CA - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xdc1801b225aea100 C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x2f5561fdf9b89b00 C=LV, O=VAS Latvijas Pasts - Vien.reg.Nr.40003052790, OU=Sertifikacijas pakalpojumi, CN=VAS Latvijas Pasts SSI(RCA)
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x6d4bbe735e24c400 C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf1fbd6404bd4a500 C=BE, O=Certipost s.a./n.v., CN=Certipost E-Trust TOP Root CA
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x407c0c3d7576bf00 C=SI, O=ACNLB
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0x331d58625ee2dc00 C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
1854.30d8: supR3HardenedWinIsDesiredRootCA: Adding 0xf03913fae404bc00 C=KR, O=KISA, OU=Korea Certification Authority Central, CN=KISA RootCA 1
1854.30d8: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=203
1854.30d8: SUPR3HardenedMain: Load Runtime...
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e4 pwszName=\Device\HarddiskVolume1\Windows\System32\ws2_32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=901DCB8172024F14E25295BF5692180F12FC8C18
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_3_for_KB3161949~31bf3856ad364e35~amd64~~6.1.1.0.cat'; file='\Device\HarddiskVolume1\Windows\System32\ws2_32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'nsi.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\ws2_32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\ws2_32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcr100.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume1\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003e8 pwszName=\Device\HarddiskVolume1\Windows\System32\nsi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5C61E0233B4D23762E0FE158DE0FDC6C24988F13
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\nsi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\nsi.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\nsi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\rpcrt4.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\msvcrt.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cbdb1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fec32a0000 LB 0x005d6000 E:\Programs\WM Box\VBoxRT.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   0000000058330000 LB 0x000d2000 E:\Programs\WM Box\MSVCR100.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   0000000058450000 LB 0x00098000 E:\Programs\WM Box\MSVCP100.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd2b0000 LB 0x0004d000 C:\Windows\system32\WS2_32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ws2_32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefec10000 LB 0x00008000 C:\Windows\system32\NSI.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\nsi.dll
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VBoxRT.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002c94c1:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fec32a0000 'E:\Programs\WM Box\VBoxRT.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\wintrust.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cd911:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefcbd0000 'C:\Windows\system32\Wintrust.dll'
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\crypt32.dll
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\crypt32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cc461:<flags> [calling]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefca60000 'C:\Windows\system32\crypt32.dll'
1854.30d8: SUPR3HardenedMain: Load TrustedMain...
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'opengl32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'uicommon.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcp100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'msvcr100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5corevbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5guivbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5widgetsvbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5openglvbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'ole32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'oleaut32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'winmm.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume1\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000043c pwszName=\Device\HarddiskVolume1\Windows\System32\winmm.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4E9A8D553148BED7B65ED40DA3FFB207DB1EAA55
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\winmm.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\winmm.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\winmm.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume1\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000041c pwszName=\Device\HarddiskVolume1\Windows\System32\oleaut32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3F3C6A8E78B194E7D963517E37487BF5CFB023A3
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\oleaut32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'gdi32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\oleaut32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\oleaut32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000430 pwszName=\Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F65178A301074201B41CE8755B2BBFA85A739FE0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\ole32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\ole32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5openglvbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5openglvbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'msvcr100.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\Qt5OpenGLVBox.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\Qt5OpenGLVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5guivbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\Qt5WidgetsVBox.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\Qt5WidgetsVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'ole32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'msvcp100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'msvcr100.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\Qt5GuiVBox.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\Qt5GuiVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcr100.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\vboxrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uicommon.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\uicommon.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcr100.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5guivbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5widgetsvbox.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ole32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume10\Programs\WM Box\UICommon.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume10\Programs\WM Box\UICommon.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume1\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000464 pwszName=\Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F331C42EC112FD278802B13D0ABF1F7F7FAADC60
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_386_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\opengl32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'glu32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'ddraw.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\opengl32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ddraw.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ddraw.dll' -> '\Device\HarddiskVolume1\Windows\System32\ddraw.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000448 pwszName=\Device\HarddiskVolume1\Windows\System32\ddraw.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=24C763EA54CD792A0F1618411061DC356EE31FF6
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nt5.cat'; file='\Device\HarddiskVolume1\Windows\System32\ddraw.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'dciman32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'dwmapi.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\ddraw.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\ddraw.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume1\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000460 pwszName=\Device\HarddiskVolume1\Windows\System32\glu32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=07408AD5E39551BE479215B6694E8769C3AB0A25
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_386_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\glu32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'opengl32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\glu32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\glu32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume1\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\oleaut32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5WidgetsVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5GuiVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\vboxrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume1\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000470 pwszName=\Device\HarddiskVolume1\Windows\System32\mpr.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F84FE9BA047B24E7694C9E0C349B48B9FD5F925B
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntpe.cat'; file='\Device\HarddiskVolume1\Windows\System32\mpr.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\mpr.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\mpr.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ws2_32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\advapi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume1\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000047c pwszName=\Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000009271c0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C9C2541533E58A076DB53A51B728E2EC7EA44F9B
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Retrying with fresh context (CryptCATAdminEnumCatalogFromHash -> 1168; iCat=0x0)
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C9C2541533E58A076DB53A51B728E2EC7EA44F9B
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERROR_NOT_FOUND (1168)
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: New context 00000000029a0170
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0170
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=347B33770A9A98D0264087BFC7888DB530EBBA3C55686F0BD6363BED9E064395
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERROR_NOT_FOUND (1168)
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
1854.30d8: supHardenedWinVerifyImageByHandle: -> -22900 (\Device\HarddiskVolume1\Windows\System32\shell32.dll) WinVerifyTrust
1854.30d8: Error (rc=0):
1854.30d8: supR3HardenedScreenImage/Imports: rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume1\Windows\System32\shell32.dll: Not signed.
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume1\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\msvcp100.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume1\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: Error (rc=0):
1854.30d8: supR3HardenedScreenImage/Imports: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5GuiVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcr100.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\msvcr100.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5corevbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5guivbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5GuiVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume10\Programs\WM Box\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5WidgetsVBox.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\user32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume1\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume1\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume1\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003b0 pwszName=\Device\HarddiskVolume1\Windows\System32\dwmapi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8BA070FC48B59A14F38A79995E6F3990D04EA2F7
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\dwmapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\dwmapi.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\dwmapi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume1\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003cc pwszName=\Device\HarddiskVolume1\Windows\System32\setupapi.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=638814E4F1F08BDE3B0DCBA93F02F14791D811C7
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\setupapi.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'cfgmgr32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'devobj.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\setupapi.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\setupapi.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dciman32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'dciman32.dll' -> '\Device\HarddiskVolume1\Windows\System32\dciman32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003c8 pwszName=\Device\HarddiskVolume1\Windows\System32\dciman32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0EBD9DA7FFE814CB41FEDF5E0965E9E9F39AD0A0
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_580_for_KB4284826~31bf3856ad364e35~amd64~~6.1.1.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\dciman32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\dciman32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\dciman32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume1\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000003c4 pwszName=\Device\HarddiskVolume1\Windows\System32\devobj.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2FD0008F21C440BEC05CC950BF703010DCBAA292
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\devobj.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'cfgmgr32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\devobj.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\devobj.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume1\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\oleaut32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000039c pwszName=\Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=00000000029a0230
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3AB181E88445DB552B76A85CA3B4C1F95F1C6AB1
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1730_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4.cat'; file='\Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll'
1854.30d8: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
1854.30d8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
1854.30d8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll) WinVerifyTrust
1854.30d8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume1\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\gdi32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume1\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume1\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
1854.30d8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume1\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
1854.30d8: supR3HardenedMonitor_LdrLoadDll: pName=E:\Programs\WM Box\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=00000000002cbdc1:<flags> [calling]
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fec63b0000 LB 0x001c8000 E:\Programs\WM Box\VirtualBoxVM.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\VirtualBoxVM.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fee8900000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\opengl32.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\glu32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fee91f0000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\glu32.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ddraw.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fee8800000 LB 0x000f1000 C:\Windows\system32\DDRAW.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ddraw.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\dciman32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fee91e0000 LB 0x00008000 C:\Windows\system32\DCIMAN32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\dciman32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd020000 LB 0x001d7000 C:\Windows\system32\SETUPAPI.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\setupapi.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcd10000 LB 0x00036000 C:\Windows\system32\CFGMGR32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\cfgmgr32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefec20000 LB 0x000da000 C:\Windows\system32\OLEAUT32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\oleaut32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefe3b0000 LB 0x001fd000 C:\Windows\system32\ole32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\ole32.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefcc10000 LB 0x0001a000 C:\Windows\system32\DEVOBJ.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\devobj.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\dwmapi.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefba40000 LB 0x00018000 C:\Windows\system32\dwmapi.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume1\Windows\System32\dwmapi.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\UICommon.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007febdde0000 LB 0x02314000 E:\Programs\WM Box\UICommon.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\UICommon.dll
1854.30d8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   0000000056a80000 LB 0x00565000 E:\Programs\WM Box\Qt5CoreVBox.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume10\Programs\WM Box\Qt5CoreVBox.dll
1854.30d8: supR3HardenedDllNotificationCallback: load   000007fefd5a0000 LB 0x00d8b000 C:\Windows\system32\SHELL32.dll [fFlags=0x0]
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: Error (rc=0):
1854.30d8: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=2 \Device\HarddiskVolume1\Windows\System32\shell32.dll
1854.30d8: Fatal error:
1854.30d8: supR3HardenedDllNotificationCallback: supR3HardenedScreenImage failed on 'C:\Windows\system32\SHELL32.dll' / '\??\C:\Windows\system32\SHELL32.dll': 0xc0000190
2a34.29b4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2143 ms, the end);
20fc.2fc4: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2621 ms, the end);
