b588.74c8: \SystemRoot\System32\ntdll.dll:
b588.74c8:     CreationTime:    2025-12-03T08:16:54.127987400Z
b588.74c8:     LastWriteTime:   2025-12-03T08:16:54.178622600Z
b588.74c8:     ChangeTime:      2025-12-28T00:15:23.544177800Z
b588.74c8:     FileAttributes:  0x20
b588.74c8:     Size:            0x1ef7b8
b588.74c8:     NT Headers:      0xe8
b588.74c8:     Timestamp:       0x7ec9c15d
b588.74c8:     Machine:         0x8664 - amd64
b588.74c8:     Timestamp:       0x7ec9c15d
b588.74c8:     Image Version:   10.0
b588.74c8:     SizeOfImage:     0x1f8000 (2064384)
b588.74c8:     Resource Dir:    0x186000 LB 0x70508
b588.74c8:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
b588.74c8:     [Raw version resource data: 0x1860f0 LB 0x380, codepage 0x0 (reserved 0x0)]
b588.74c8:     ProductName:     Microsoft® Windows® Operating System
b588.74c8:     ProductVersion:  10.0.19041.6456
b588.74c8:     FileVersion:     10.0.19041.6456 (WinBuild.160101.0800)
b588.74c8:     FileDescription: NT Layer DLL
b588.74c8: \SystemRoot\System32\kernel32.dll:
b588.74c8:     CreationTime:    2025-06-12T01:51:07.424621900Z
b588.74c8:     LastWriteTime:   2025-06-12T01:51:07.442620800Z
b588.74c8:     ChangeTime:      2025-12-28T00:15:23.387527600Z
b588.74c8:     FileAttributes:  0x20
b588.74c8:     Size:            0xbf568
b588.74c8:     NT Headers:      0xf8
b588.74c8:     Timestamp:       0xeee0fc1a
b588.74c8:     Machine:         0x8664 - amd64
b588.74c8:     Timestamp:       0xeee0fc1a
b588.74c8:     Image Version:   10.0
b588.74c8:     SizeOfImage:     0xc2000 (794624)
b588.74c8:     Resource Dir:    0xc0000 LB 0x520
b588.74c8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
b588.74c8:     [Raw version resource data: 0xc00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
b588.74c8:     ProductName:     Microsoft® Windows® Operating System
b588.74c8:     ProductVersion:  10.0.19041.5915
b588.74c8:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
b588.74c8:     FileDescription: Windows NT BASE API Client DLL
b588.74c8: \SystemRoot\System32\KernelBase.dll:
b588.74c8:     CreationTime:    2025-12-03T08:16:55.078266800Z
b588.74c8:     LastWriteTime:   2025-12-03T08:16:55.191268200Z
b588.74c8:     ChangeTime:      2025-12-28T00:15:23.578934700Z
b588.74c8:     FileAttributes:  0x20
b588.74c8:     Size:            0x2f7a40
b588.74c8:     NT Headers:      0x100
b588.74c8:     Timestamp:       0x56511854
b588.74c8:     Machine:         0x8664 - amd64
b588.74c8:     Timestamp:       0x56511854
b588.74c8:     Image Version:   10.0
b588.74c8:     SizeOfImage:     0x2f6000 (3104768)
b588.74c8:     Resource Dir:    0x2cc000 LB 0x548
b588.74c8:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
b588.74c8:     [Raw version resource data: 0x2cc0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
b588.74c8:     ProductName:     Microsoft® Windows® Operating System
b588.74c8:     ProductVersion:  10.0.19041.6280
b588.74c8:     FileVersion:     10.0.19041.6280 (WinBuild.160101.0800)
b588.74c8:     FileDescription: Windows NT BASE API Client DLL
b588.74c8: \SystemRoot\System32\apisetschema.dll:
b588.74c8:     CreationTime:    2025-06-12T01:50:46.852431700Z
b588.74c8:     LastWriteTime:   2025-06-12T01:50:46.856431300Z
b588.74c8:     ChangeTime:      2025-12-03T08:17:47.931703400Z
b588.74c8:     FileAttributes:  0x20
b588.74c8:     Size:            0x1f9c8
b588.74c8:     NT Headers:      0xd0
b588.74c8:     Timestamp:       0x85f6b378
b588.74c8:     Machine:         0x8664 - amd64
b588.74c8:     Timestamp:       0x85f6b378
b588.74c8:     Image Version:   10.0
b588.74c8:     SizeOfImage:     0x20000 (131072)
b588.74c8:     Resource Dir:    0x1f000 LB 0x408
b588.74c8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
b588.74c8:     [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
b588.74c8:     ProductName:     Microsoft® Windows® Operating System
b588.74c8:     ProductVersion:  10.0.19041.5915
b588.74c8:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
b588.74c8:     FileDescription: ApiSet Schema DLL
b588.74c8: NtOpenDirectoryObject failed on \Driver: 0xc0000022
b588.74c8: supR3HardenedWinFindAdversaries: 0x0
b588.74c8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume7\Programs\VirtualBox'
b588.74c8: Calling main()
b588.74c8: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
b588.74c8: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume7\Programs\VirtualBox'
b588.74c8: SUPR3HardenedMain: Respawn #1
b588.74c8: System32:  \Device\HarddiskVolume2\Windows\System32
b588.74c8: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
b588.74c8: KnownDllPath: C:\Windows\System32
b588.74c8: supR3HardenedWinInit: Performing a limited self purification...
b588.74c8: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
b588.74c8:  *0000000000000000-000000007ffdffff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffe1000-000000007ffedfff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffee000-000000007ffeefff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffef000-0000001e12bfffff 0x0001/0x0000 0x0000000
b588.74c8:  *0000001e12c00000-0000001e12c44fff 0x0000/0x0004 0x0020000
b588.74c8:   0000001e12c45000-0000001e12c47fff 0x0004/0x0004 0x0020000
b588.74c8:   0000001e12c48000-0000001e12dfffff 0x0000/0x0004 0x0020000
b588.74c8:  *0000001e12e00000-0000001e12eb8fff 0x0000/0x0004 0x0020000
b588.74c8:   0000001e12eb9000-0000001e12ebbfff 0x0104/0x0004 0x0020000
b588.74c8:   0000001e12ebc000-0000001e12efffff 0x0004/0x0004 0x0020000
b588.74c8:   0000001e12f00000-00000200b835ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b8360000-00000200b836ffff 0x0004/0x0004 0x0040000
b588.74c8:  *00000200b8370000-00000200b8371fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b8372000-00000200b837ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b8380000-00000200b839cfff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b839d000-00000200b839ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b83a0000-00000200b83a3fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b83a4000-00000200b83affff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b83b0000-00000200b83b0fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b83b1000-00000200b83bffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b83c0000-00000200b83c1fff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b83c2000-00000200b83cffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b83d0000-00000200b8498fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b8499000-00000200b849ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b84a0000-00000200b84a1fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b84a2000-00000200b84affff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b84b0000-00000200b84b0fff 0x0002/0x0002 0x0040000
b588.74c8:   00000200b84b1000-00000200b84bffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b84c0000-00000200b84c6fff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b84c7000-00000200b85bffff 0x0000/0x0004 0x0020000
b588.74c8:  *00000200b85c0000-00000200b85c1fff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b85c2000-00000200b8621fff 0x0000/0x0004 0x0020000
b588.74c8:   00000200b8622000-00000200b862ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b8630000-00000200b865dfff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b865e000-00000200b872ffff 0x0000/0x0004 0x0020000
b588.74c8:   00000200b8730000-00000200b873ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000200b8740000-00000200b874efff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b874f000-00000200b874ffff 0x0000/0x0004 0x0020000
b588.74c8:  *00000200b8750000-00000200b875afff 0x0000/0x0004 0x0020000
b588.74c8:   00000200b875b000-00000200b8953fff 0x0004/0x0004 0x0020000
b588.74c8:   00000200b8954000-00000200b8954fff 0x0000/0x0004 0x0020000
b588.74c8:   00000200b8955000-00007df4fc93ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df4fc940000-00007df4fc944fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df4fc945000-00007df4fca3ffff 0x0000/0x0002 0x0040000
b588.74c8:  *00007df4fca40000-00007df5fca5ffff 0x0000/0x0004 0x0020000
b588.74c8:  *00007df5fca60000-00007df5fea5ffff 0x0000/0x0004 0x0020000
b588.74c8:   00007df5fea60000-00007df5fea60fff 0x0004/0x0004 0x0020000
b588.74c8:   00007df5fea61000-00007df5fea6ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5fea70000-00007df5fea70fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5fea71000-00007df5fea7ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5fea80000-00007df5feaa2fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5feaa3000-00007df5feaaffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5feab0000-00007df5ffec1fff 0x0000/0x0001 0x0040000
b588.74c8:   00007df5ffec2000-00007df5fff7bfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df5fff7c000-00007df60088bfff 0x0000/0x0001 0x0040000
b588.74c8:   00007df60088c000-00007df60088cfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df60088d000-00007ff5d72d4fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff5d72d5000-00007ff5d72d9fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff5d72da000-00007ff5f3d91fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff5f3d92000-00007ff5f9aa9fff 0x0001/0x0001 0x0040000
b588.74c8:   00007ff5f9aaa000-00007ff5f9ab5fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff5f9ab6000-00007ff5f9b18fff 0x0001/0x0001 0x0040000
b588.74c8:   00007ff5f9b19000-00007ff5f9b1cfff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff5f9b1d000-00007ff5f9b4efff 0x0001/0x0001 0x0040000
b588.74c8:   00007ff5f9b4f000-00007ff5f9b57fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff5f9b58000-00007ff5feaaffff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff5feab0000-00007ff62093ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ff620940000-00007ff620940fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620941000-00007ff6209aafff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ab000-00007ff6209abfff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ac000-00007ff6209fefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ff000-00007ff620a01fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a02000-00007ff620a04fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a05000-00007ff620a07fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a08000-00007ff620a08fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a09000-00007ff620a0afff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a0b000-00007ff620a0bfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a0c000-00007ff620a53fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a54000-00007ffebfe7ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ffebfe80000-00007ffebfe80fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
b588.74c8:   00007ffebfe81000-00007ffebffb1fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
b588.74c8:   00007ffebffb2000-00007ffec0134fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
b588.74c8:   00007ffec0135000-00007ffec0139fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
b588.74c8:   00007ffec013a000-00007ffec0175fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
b588.74c8:   00007ffec0176000-00007ffec1a6ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ffec1a70000-00007ffec1a70fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\kernel32.dll
b588.74c8:   00007ffec1a71000-00007ffec1af1fff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\kernel32.dll
b588.74c8:   00007ffec1af2000-00007ffec1b26fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\kernel32.dll
b588.74c8:   00007ffec1b27000-00007ffec1b28fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\kernel32.dll
b588.74c8:   00007ffec1b29000-00007ffec1b31fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\kernel32.dll
b588.74c8:   00007ffec1b32000-00007ffec27effff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ffec27f0000-00007ffec27f0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec27f1000-00007ffec290cfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec290d000-00007ffec2955fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2956000-00007ffec2956fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2957000-00007ffec2958fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2959000-00007ffec2961fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2962000-00007ffec29e7fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec29e8000-00007ffffffeffff 0x0001/0x0000 0x0000000
b588.74c8: kernel32.dll: timestamp 0xeee0fc1a (rc=VINF_SUCCESS)
b588.74c8: kernelbase.dll: timestamp 0x56511854 (rc=VINF_SUCCESS)
b588.74c8: VirtualBoxVM.exe: timestamp 0x65a53a70 (rc=VINF_SUCCESS)
b588.74c8: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
b588.74c8: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
b588.74c8: VirtualBoxVM.exe: Differences in section #7 (.00cfg) between file and memory:
b588.74c8:   00007ff620a13000 / 0x00d3000: 00 != 60
b588.74c8:   00007ff620a13001 / 0x00d3001: 0d != cc
b588.74c8:   00007ff620a13002 / 0x00d3002: 96 != 87
b588.74c8:   00007ff620a13003 / 0x00d3003: 20 != c2
b588.74c8:   00007ff620a13004 / 0x00d3004: f6 != fe
b588.74c8:   00007ff620a13010 / 0x00d3010: 30 != 00
b588.74c8:   00007ff620a13011 / 0x00d3011: aa != cd
b588.74c8:   00007ff620a13012 / 0x00d3012: 9a != 87
b588.74c8:   00007ff620a13013 / 0x00d3013: 20 != c2
b588.74c8:   00007ff620a13014 / 0x00d3014: f6 != fe
b588.74c8:   Restored 0x28 bytes of original file content at 00007ff620a13000
b588.74c8: VirtualBoxVM.exe: Differences in section #8 (.rsrc) between file and memory:
b588.74c8:   00007ff620a525f4 / 0x01125f4: 00 != 50
b588.74c8:   00007ff620a525f5 / 0x01125f5: 00 != 41
b588.74c8:   00007ff620a525f6 / 0x01125f6: 00 != 44
b588.74c8:   00007ff620a525f7 / 0x01125f7: 00 != 44
b588.74c8:   00007ff620a525f8 / 0x01125f8: 00 != 49
b588.74c8:   00007ff620a525f9 / 0x01125f9: 00 != 4e
b588.74c8:   00007ff620a525fa / 0x01125fa: 00 != 47
b588.74c8:   00007ff620a525fb / 0x01125fb: 00 != 58
b588.74c8:   00007ff620a525fc / 0x01125fc: 00 != 58
b588.74c8:   00007ff620a525fd / 0x01125fd: 00 != 50
b588.74c8:   00007ff620a525fe / 0x01125fe: 00 != 41
b588.74c8:   00007ff620a525ff / 0x01125ff: 00 != 44
b588.74c8:   Restored 0xa0c bytes of original file content at 00007ff620a525f4
b588.74c8: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
b588.74c8: ntdll.dll: Differences in section #8 (.00cfg) between file and memory:
b588.74c8:   00007ffec2975000 / 0x0185000: b0 != 00
b588.74c8:   00007ffec2975001 / 0x0185001: 10 != cd
b588.74c8:   00007ffec2975002 / 0x0185002: 89 != 87
b588.74c8:   Restored 0x8 bytes of original file content at 00007ffec2975000
b588.74c8: kernel32.dll: Differences in section #2 (.rdata) between file and memory:
b588.74c8:   00007ffec1af6640 / 0x0086640: e0 != 60
b588.74c8:   00007ffec1af6641 / 0x0086641: 8e != cc
b588.74c8:   00007ffec1af6642 / 0x0086642: a9 != 87
b588.74c8:   00007ffec1af6643 / 0x0086643: c1 != c2
b588.74c8:   00007ffec1af6649 / 0x0086649: 91 != cd
b588.74c8:   00007ffec1af664a / 0x008664a: a9 != 87
b588.74c8:   00007ffec1af664b / 0x008664b: c1 != c2
b588.74c8:   Restored 0x2000 bytes of original file content at 00007ffec1af6000
b588.74c8: kernelbase.dll: Differences in section #2 (.rdata) between file and memory:
b588.74c8:   00007ffec0064100 / 0x01e4100: 50 != 60
b588.74c8:   00007ffec0064101 / 0x01e4101: 6c != cc
b588.74c8:   00007ffec0064102 / 0x01e4102: f3 != 87
b588.74c8:   00007ffec0064103 / 0x01e4103: bf != c2
b588.74c8:   00007ffec0064109 / 0x01e4109: 70 != cd
b588.74c8:   00007ffec006410a / 0x01e410a: f3 != 87
b588.74c8:   00007ffec006410b / 0x01e410b: bf != c2
b588.74c8:   Restored 0x2000 bytes of original file content at 00007ffec0064000
b588.74c8: supHardNtVpCheckHandles:
b588.74c8: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=5
b588.74c8: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
b588.74c8: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
b588.74c8: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe)
b588.74c8: supR3HardNtEnableThreadCreationEx:
b588.74c8: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffec2865c10 pvNtTerminateThread=00007ffec288dff0
b588.74c8: supR3HardenedWinDoReSpawn(1): New child 6cd0.7988 [kernel32].
b588.74c8: supR3HardNtChildGatherData: PebBaseAddress=00000071e0b22000 cbPeb=0x388
b588.74c8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffec27f0000 uNtDllChildAddr=00007ffec27f0000
b588.74c8: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffec2865c10
b588.74c8: supR3HardenedWinSetupChildInit: Initial context:
  rax=0000000000000000 rbx=0000000000000000 rcx=00007ff62094b7a0 rdx=00000071e0b22000
  rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  r14=0000000000000000 r15=0000000000000000  P1=0000000000000000  P2=0000000000000000
  rip=00007ffec283cc70 rsp=00000071e094f9c8 rbp=0000000000000000    ctxflags=0010001b
  cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000    eflags=00000200   mxcrx=00001f80
   P3=0000000000000000  P4=0000000000000000  P5=0000000000000000  P6=0000000000000000
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
b588.74c8: supR3HardenedWinSetupChildInit: Start child.
b588.74c8: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 1 ms.
b588.74c8: supR3HardNtChildPurify: Startup delay kludge #1/0: 271 ms, 17 sleeps
b588.74c8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
b588.74c8:  *0000000000000000-000000007ffdffff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffe1000-000000007ffedfff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffee000-000000007ffeefff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffef000-00000071e084ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000071e0850000-00000071e094afff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e094b000-00000071e094dfff 0x0104/0x0004 0x0020000
b588.74c8:   00000071e094e000-00000071e094ffff 0x0004/0x0004 0x0020000
b588.74c8:   00000071e0950000-00000071e09fffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000071e0a00000-00000071e0b21fff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e0b22000-00000071e0b24fff 0x0004/0x0004 0x0020000
b588.74c8:   00000071e0b25000-00000071e0bfffff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e0c00000-000001b40101ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401020000-000001b40103ffff 0x0004/0x0004 0x0020000
b588.74c8:  *000001b401040000-000001b40105cfff 0x0002/0x0002 0x0040000
b588.74c8:   000001b40105d000-000001b40105ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401060000-000001b401063fff 0x0002/0x0002 0x0040000
b588.74c8:   000001b401064000-000001b40106ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401070000-000001b401070fff 0x0002/0x0002 0x0040000
b588.74c8:   000001b401071000-000001b40107ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401080000-000001b401081fff 0x0004/0x0004 0x0020000
b588.74c8:   000001b401082000-00007df5013affff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013b0000-00007df5013b0fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5013b1000-00007df5013bffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013c0000-00007df5013e2fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5013e3000-00007df5013effff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013f0000-00007df502801fff 0x0000/0x0001 0x0040000
b588.74c8:   00007df502802000-00007df5028bbfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df5028bc000-00007df5031cbfff 0x0000/0x0001 0x0040000
b588.74c8:   00007df5031cc000-00007df5031ccfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df5031cd000-00007ff4d9c14fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff4d9c15000-00007ff4d9c19fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff4d9c1a000-00007ff4f66d1fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff4f66d2000-00007ff4fc48efff 0x0001/0x0001 0x0040000
b588.74c8:   00007ff4fc48f000-00007ff4fc497fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff4fc498000-00007ff5013effff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff5013f0000-00007ff62093ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ff620940000-00007ff620940fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620941000-00007ff6209aafff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ab000-00007ff6209abfff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ac000-00007ff6209fefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ff000-00007ff6209fffff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a00000-00007ff620a00fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a01000-00007ff620a05fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a06000-00007ff620a0bfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a0c000-00007ff620a53fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a54000-00007ffec27effff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ffec27f0000-00007ffec27f0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec27f1000-00007ffec290cfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec290d000-00007ffec2955fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2956000-00007ffec2961fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2962000-00007ffec2970fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2971000-00007ffec2971fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2972000-00007ffec2974fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2975000-00007ffec29e7fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec29e8000-00007ffffffeffff 0x0001/0x0000 0x0000000
b588.74c8: VirtualBoxVM.exe: Differences in section #8 (.rsrc) between file and memory:
b588.74c8:   00007ff620a525f4 / 0x01125f4: 00 != 50
b588.74c8:   00007ff620a525f5 / 0x01125f5: 00 != 41
b588.74c8:   00007ff620a525f6 / 0x01125f6: 00 != 44
b588.74c8:   00007ff620a525f7 / 0x01125f7: 00 != 44
b588.74c8:   00007ff620a525f8 / 0x01125f8: 00 != 49
b588.74c8:   00007ff620a525f9 / 0x01125f9: 00 != 4e
b588.74c8:   00007ff620a525fa / 0x01125fa: 00 != 47
b588.74c8:   00007ff620a525fb / 0x01125fb: 00 != 58
b588.74c8:   00007ff620a525fc / 0x01125fc: 00 != 58
b588.74c8:   00007ff620a525fd / 0x01125fd: 00 != 50
b588.74c8:   00007ff620a525fe / 0x01125fe: 00 != 41
b588.74c8:   00007ff620a525ff / 0x01125ff: 00 != 44
b588.74c8:   Restored 0xa0c bytes of original file content at 00007ff620a525f4
b588.74c8: supR3HardNtChildPurify: cFixes=1 g_fSupAdversaries=0x80000000
b588.74c8: supR3HardNtChildPurify: Startup delay kludge #1/1: 526 ms, 34 sleeps
b588.74c8: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
b588.74c8:  *0000000000000000-000000007ffdffff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffe1000-000000007ffedfff 0x0001/0x0000 0x0000000
b588.74c8:  *000000007ffee000-000000007ffeefff 0x0002/0x0002 0x0020000
b588.74c8:   000000007ffef000-00000071e084ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000071e0850000-00000071e094afff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e094b000-00000071e094dfff 0x0104/0x0004 0x0020000
b588.74c8:   00000071e094e000-00000071e094ffff 0x0004/0x0004 0x0020000
b588.74c8:   00000071e0950000-00000071e09fffff 0x0001/0x0000 0x0000000
b588.74c8:  *00000071e0a00000-00000071e0b21fff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e0b22000-00000071e0b24fff 0x0004/0x0004 0x0020000
b588.74c8:   00000071e0b25000-00000071e0bfffff 0x0000/0x0004 0x0020000
b588.74c8:   00000071e0c00000-000001b40101ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401020000-000001b40103ffff 0x0004/0x0004 0x0020000
b588.74c8:  *000001b401040000-000001b40105cfff 0x0002/0x0002 0x0040000
b588.74c8:   000001b40105d000-000001b40105ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401060000-000001b401063fff 0x0002/0x0002 0x0040000
b588.74c8:   000001b401064000-000001b40106ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401070000-000001b401070fff 0x0002/0x0002 0x0040000
b588.74c8:   000001b401071000-000001b40107ffff 0x0001/0x0000 0x0000000
b588.74c8:  *000001b401080000-000001b401081fff 0x0004/0x0004 0x0020000
b588.74c8:   000001b401082000-00007df5013affff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013b0000-00007df5013b0fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5013b1000-00007df5013bffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013c0000-00007df5013e2fff 0x0002/0x0002 0x0040000
b588.74c8:   00007df5013e3000-00007df5013effff 0x0001/0x0000 0x0000000
b588.74c8:  *00007df5013f0000-00007df502801fff 0x0000/0x0001 0x0040000
b588.74c8:   00007df502802000-00007df5028bbfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df5028bc000-00007df5031cbfff 0x0000/0x0001 0x0040000
b588.74c8:   00007df5031cc000-00007df5031ccfff 0x0001/0x0001 0x0040000
b588.74c8:   00007df5031cd000-00007ff4d9c14fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff4d9c15000-00007ff4d9c19fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff4d9c1a000-00007ff4f66d1fff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff4f66d2000-00007ff4fc48efff 0x0001/0x0001 0x0040000
b588.74c8:   00007ff4fc48f000-00007ff4fc497fff 0x0002/0x0001 0x0040000
b588.74c8:   00007ff4fc498000-00007ff5013effff 0x0000/0x0001 0x0040000
b588.74c8:   00007ff5013f0000-00007ff62093ffff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ff620940000-00007ff620940fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620941000-00007ff6209aafff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ab000-00007ff6209abfff 0x0040/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ac000-00007ff6209fefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff6209ff000-00007ff620a0bfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a0c000-00007ff620a53fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
b588.74c8:   00007ff620a54000-00007ffec27effff 0x0001/0x0000 0x0000000
b588.74c8:  *00007ffec27f0000-00007ffec27f0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec27f1000-00007ffec290cfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec290d000-00007ffec2955fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2956000-00007ffec2959fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec295a000-00007ffec2961fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2962000-00007ffec2970fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2971000-00007ffec2971fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2972000-00007ffec2974fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec2975000-00007ffec29e7fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
b588.74c8:   00007ffec29e8000-00007ffffffeffff 0x0001/0x0000 0x0000000
b588.74c8: supR3HardNtChildPurify: Done after 801 ms and 1 fixes (loop #1).
6cd0.7988: supR3HardenedVmProcessInit: uNtDllAddr=00007ffec27f0000 g_uNtVerCombined=0xa04a6500 (stack ~00000071e094e7a0)
6cd0.7988: ntdll.dll: timestamp 0x7ec9c15d (rc=VINF_SUCCESS)
6cd0.7988: New simple heap: #1 000001b401190000 LB 0x400000 (for 2064384 allocation)
6cd0.7988: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume7\Programs\VirtualBox'
b588.74c8: supR3HardNtEnableThreadCreationEx:
6cd0.7988: System32:  \Device\HarddiskVolume2\Windows\System32
6cd0.7988: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
6cd0.7988: KnownDllPath: C:\Windows\System32
6cd0.7988: supR3HardenedVmProcessInit: Opening vboxsup stub...
6cd0.7988: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
6cd0.7988: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
6cd0.7988: Registered Dll notification callback with NTDLL.
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6cd0.7988: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ffebfe80000 LB 0x002f6000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ffec1a70000 LB 0x000c2000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
6cd0.7988: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
6cd0.7988: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\KERNEL32.DLL'
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ff620940000 LB 0x00114000 D:\Programs\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
6cd0.7988: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
6cd0.7988: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffec2865c10 pvNtTerminateThread=00007ffec288dff0
b588.74c8: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 80 ms.
6cd0.7988: \SystemRoot\System32\ntdll.dll:
6cd0.7988:     CreationTime:    2025-12-03T08:16:54.127987400Z
6cd0.7988:     LastWriteTime:   2025-12-03T08:16:54.178622600Z
6cd0.7988:     ChangeTime:      2025-12-28T00:15:23.544177800Z
6cd0.7988:     FileAttributes:  0x20
6cd0.7988:     Size:            0x1ef7b8
6cd0.7988:     NT Headers:      0xe8
6cd0.7988:     Timestamp:       0x7ec9c15d
6cd0.7988:     Machine:         0x8664 - amd64
6cd0.7988:     Timestamp:       0x7ec9c15d
6cd0.7988:     Image Version:   10.0
6cd0.7988:     SizeOfImage:     0x1f8000 (2064384)
6cd0.7988:     Resource Dir:    0x186000 LB 0x70508
6cd0.7988:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
6cd0.7988:     [Raw version resource data: 0x1860f0 LB 0x380, codepage 0x0 (reserved 0x0)]
6cd0.7988:     ProductName:     Microsoft® Windows® Operating System
6cd0.7988:     ProductVersion:  10.0.19041.6456
6cd0.7988:     FileVersion:     10.0.19041.6456 (WinBuild.160101.0800)
6cd0.7988:     FileDescription: NT Layer DLL
6cd0.7988: \SystemRoot\System32\kernel32.dll:
6cd0.7988:     CreationTime:    2025-06-12T01:51:07.424621900Z
6cd0.7988:     LastWriteTime:   2025-06-12T01:51:07.442620800Z
6cd0.7988:     ChangeTime:      2025-12-28T00:15:23.387527600Z
6cd0.7988:     FileAttributes:  0x20
6cd0.7988:     Size:            0xbf568
6cd0.7988:     NT Headers:      0xf8
6cd0.7988:     Timestamp:       0xeee0fc1a
6cd0.7988:     Machine:         0x8664 - amd64
6cd0.7988:     Timestamp:       0xeee0fc1a
6cd0.7988:     Image Version:   10.0
6cd0.7988:     SizeOfImage:     0xc2000 (794624)
6cd0.7988:     Resource Dir:    0xc0000 LB 0x520
6cd0.7988:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
6cd0.7988:     [Raw version resource data: 0xc00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
6cd0.7988:     ProductName:     Microsoft® Windows® Operating System
6cd0.7988:     ProductVersion:  10.0.19041.5915
6cd0.7988:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
6cd0.7988:     FileDescription: Windows NT BASE API Client DLL
6cd0.7988: \SystemRoot\System32\KernelBase.dll:
6cd0.7988:     CreationTime:    2025-12-03T08:16:55.078266800Z
6cd0.7988:     LastWriteTime:   2025-12-03T08:16:55.191268200Z
6cd0.7988:     ChangeTime:      2025-12-28T00:15:23.578934700Z
6cd0.7988:     FileAttributes:  0x20
6cd0.7988:     Size:            0x2f7a40
6cd0.7988:     NT Headers:      0x100
6cd0.7988:     Timestamp:       0x56511854
6cd0.7988:     Machine:         0x8664 - amd64
6cd0.7988:     Timestamp:       0x56511854
6cd0.7988:     Image Version:   10.0
6cd0.7988:     SizeOfImage:     0x2f6000 (3104768)
6cd0.7988:     Resource Dir:    0x2cc000 LB 0x548
6cd0.7988:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
6cd0.7988:     [Raw version resource data: 0x2cc0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
6cd0.7988:     ProductName:     Microsoft® Windows® Operating System
6cd0.7988:     ProductVersion:  10.0.19041.6280
6cd0.7988:     FileVersion:     10.0.19041.6280 (WinBuild.160101.0800)
6cd0.7988:     FileDescription: Windows NT BASE API Client DLL
6cd0.7988: \SystemRoot\System32\apisetschema.dll:
6cd0.7988:     CreationTime:    2025-06-12T01:50:46.852431700Z
6cd0.7988:     LastWriteTime:   2025-06-12T01:50:46.856431300Z
6cd0.7988:     ChangeTime:      2025-12-03T08:17:47.931703400Z
6cd0.7988:     FileAttributes:  0x20
6cd0.7988:     Size:            0x1f9c8
6cd0.7988:     NT Headers:      0xd0
6cd0.7988:     Timestamp:       0x85f6b378
6cd0.7988:     Machine:         0x8664 - amd64
6cd0.7988:     Timestamp:       0x85f6b378
6cd0.7988:     Image Version:   10.0
6cd0.7988:     SizeOfImage:     0x20000 (131072)
6cd0.7988:     Resource Dir:    0x1f000 LB 0x408
6cd0.7988:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
6cd0.7988:     [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
6cd0.7988:     ProductName:     Microsoft® Windows® Operating System
6cd0.7988:     ProductVersion:  10.0.19041.5915
6cd0.7988:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
6cd0.7988:     FileDescription: ApiSet Schema DLL
6cd0.7988: NtOpenDirectoryObject failed on \Driver: 0xc0000022
6cd0.7988: supR3HardenedWinFindAdversaries: 0x0
6cd0.7988: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume7\Programs\VirtualBox'
6cd0.7988: Calling main()
6cd0.7988: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
6cd0.7988: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume7\Programs\VirtualBox'
6cd0.7988: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
6cd0.7988: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe)
6cd0.7988: SUPR3HardenedMain: Respawn #2
6cd0.7988: supR3HardNtEnableThreadCreationEx:
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ffec0930000 LB 0x00120000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ffec06f0000 LB 0x00027000 C:\Windows\System32\bcrypt.dll [fFlags=0x0]
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
6cd0.7988: supR3HardenedDllNotificationCallback: load   00007ffec1920000 LB 0x0009f000 C:\Windows\System32\sechost.dll [fFlags=0x0]
6cd0.7988: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
6cd0.7988: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'bcrypt.dll'.
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
6cd0.7988: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
6cd0.7988: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntdll.dll)
6cd0.7988: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6cd0.7988: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6cd0.7988: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
6cd0.7988: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6cd0.7988: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6cd0.7988: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6cd0.7988: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6cd0.7988: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\System32\ntdll.dll'
6cd0.7988: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffec2865c10 pvNtTerminateThread=00007ffec288dff0
6cd0.7988: supR3HardenedWinDoReSpawn(2): New child 6c5c.4de0 [kernel32].
6cd0.7988: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
6cd0.7988: supR3HardNtChildGatherData: PebBaseAddress=000000fe20568000 cbPeb=0x388
6cd0.7988: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffec27f0000 uNtDllChildAddr=00007ffec27f0000
6cd0.7988: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffec2865c10
6cd0.7988: supR3HardenedWinSetupChildInit: Initial context:
  rax=0000000000000000 rbx=0000000000000000 rcx=00007ff62094b7a0 rdx=000000fe20568000
  rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
  r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
  r14=0000000000000000 r15=0000000000000000  P1=0000000000000000  P2=0000000000000000
  rip=00007ffec283cc70 rsp=000000fe203ffc38 rbp=0000000000000000    ctxflags=0010001b
  cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000    eflags=00000200   mxcrx=00001f80
   P3=0000000000000000  P4=0000000000000000  P5=0000000000000000  P6=0000000000000000
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
6cd0.7988: kernel32.dll: timestamp 0xeee0fc1a (rc=VINF_SUCCESS)
6cd0.7988: supR3HardenedWinSetupChildInit: Start child.
6cd0.7988: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
6cd0.7988: supR3HardNtChildPurify: Startup delay kludge #1/0: 259 ms, 16 sleeps
6cd0.7988: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
6cd0.7988:  *0000000000000000-000000007ffdffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
6cd0.7988:   000000007ffe1000-000000007ffedfff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000007ffee000-000000007ffeefff 0x0002/0x0002 0x0020000
6cd0.7988:   000000007ffef000-000000fe202fffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000fe20300000-000000fe203fafff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe203fb000-000000fe203fdfff 0x0104/0x0004 0x0020000
6cd0.7988:   000000fe203fe000-000000fe203fffff 0x0004/0x0004 0x0020000
6cd0.7988:  *000000fe20400000-000000fe20567fff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe20568000-000000fe2056afff 0x0004/0x0004 0x0020000
6cd0.7988:   000000fe2056b000-000000fe205fffff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe20600000-000002ebd691ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6920000-000002ebd693ffff 0x0004/0x0004 0x0020000
6cd0.7988:  *000002ebd6940000-000002ebd695cfff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd695d000-000002ebd695ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6960000-000002ebd6963fff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd6964000-000002ebd696ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6970000-000002ebd6970fff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd6971000-000002ebd697ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6980000-000002ebd6981fff 0x0004/0x0004 0x0020000
6cd0.7988:   000002ebd6982000-00007df554edffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554ee0000-00007df554ee0fff 0x0002/0x0002 0x0040000
6cd0.7988:   00007df554ee1000-00007df554eeffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554ef0000-00007df554f12fff 0x0002/0x0002 0x0040000
6cd0.7988:   00007df554f13000-00007df554f1ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554f20000-00007df556331fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007df556332000-00007df5563ebfff 0x0001/0x0001 0x0040000
6cd0.7988:   00007df5563ec000-00007df556cfbfff 0x0000/0x0001 0x0040000
6cd0.7988:   00007df556cfc000-00007df556cfcfff 0x0001/0x0001 0x0040000
6cd0.7988:   00007df556cfd000-00007ff52d744fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff52d745000-00007ff52d749fff 0x0002/0x0001 0x0040000
6cd0.7988:   00007ff52d74a000-00007ff54a201fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff54a202000-00007ff54ffbefff 0x0001/0x0001 0x0040000
6cd0.7988:   00007ff54ffbf000-00007ff54ffc7fff 0x0002/0x0001 0x0040000
6cd0.7988:   00007ff54ffc8000-00007ff554f1ffff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff554f20000-00007ff62093ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007ff620940000-00007ff620940fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620941000-00007ff6209aafff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ab000-00007ff6209abfff 0x0080/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ac000-00007ff6209fefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ff000-00007ff6209fffff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a00000-00007ff620a00fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a01000-00007ff620a05fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a06000-00007ff620a0bfff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a0c000-00007ff620a53fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a54000-00007ffec27effff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007ffec27f0000-00007ffec27f0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec27f1000-00007ffec290cfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec290d000-00007ffec2955fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2956000-00007ffec2961fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2962000-00007ffec2970fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2971000-00007ffec2971fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2972000-00007ffec2974fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2975000-00007ffec29e7fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec29e8000-00007ffffffeffff 0x0001/0x0000 0x0000000
6cd0.7988: VirtualBoxVM.exe: timestamp 0x65a53a70 (rc=VINF_SUCCESS)
6cd0.7988: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
6cd0.7988: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
6cd0.7988: VirtualBoxVM.exe: Differences in section #8 (.rsrc) between file and memory:
6cd0.7988:   00007ff620a525f4 / 0x01125f4: 00 != 50
6cd0.7988:   00007ff620a525f5 / 0x01125f5: 00 != 41
6cd0.7988:   00007ff620a525f6 / 0x01125f6: 00 != 44
6cd0.7988:   00007ff620a525f7 / 0x01125f7: 00 != 44
6cd0.7988:   00007ff620a525f8 / 0x01125f8: 00 != 49
6cd0.7988:   00007ff620a525f9 / 0x01125f9: 00 != 4e
6cd0.7988:   00007ff620a525fa / 0x01125fa: 00 != 47
6cd0.7988:   00007ff620a525fb / 0x01125fb: 00 != 58
6cd0.7988:   00007ff620a525fc / 0x01125fc: 00 != 58
6cd0.7988:   00007ff620a525fd / 0x01125fd: 00 != 50
6cd0.7988:   00007ff620a525fe / 0x01125fe: 00 != 41
6cd0.7988:   00007ff620a525ff / 0x01125ff: 00 != 44
6cd0.7988:   Restored 0xa0c bytes of original file content at 00007ff620a525f4
6cd0.7988: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
6cd0.7988: supR3HardNtChildPurify: cFixes=1 g_fSupAdversaries=0x80000000
6cd0.7988: supR3HardNtChildPurify: Startup delay kludge #1/1: 522 ms, 33 sleeps
6cd0.7988: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
6cd0.7988:  *0000000000000000-000000007ffdffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
6cd0.7988:   000000007ffe1000-000000007ffedfff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000007ffee000-000000007ffeefff 0x0002/0x0002 0x0020000
6cd0.7988:   000000007ffef000-000000fe202fffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000000fe20300000-000000fe203fafff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe203fb000-000000fe203fdfff 0x0104/0x0004 0x0020000
6cd0.7988:   000000fe203fe000-000000fe203fffff 0x0004/0x0004 0x0020000
6cd0.7988:  *000000fe20400000-000000fe20567fff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe20568000-000000fe2056afff 0x0004/0x0004 0x0020000
6cd0.7988:   000000fe2056b000-000000fe205fffff 0x0000/0x0004 0x0020000
6cd0.7988:   000000fe20600000-000002ebd691ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6920000-000002ebd693ffff 0x0004/0x0004 0x0020000
6cd0.7988:  *000002ebd6940000-000002ebd695cfff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd695d000-000002ebd695ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6960000-000002ebd6963fff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd6964000-000002ebd696ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6970000-000002ebd6970fff 0x0002/0x0002 0x0040000
6cd0.7988:   000002ebd6971000-000002ebd697ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *000002ebd6980000-000002ebd6981fff 0x0004/0x0004 0x0020000
6cd0.7988:   000002ebd6982000-00007df554edffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554ee0000-00007df554ee0fff 0x0002/0x0002 0x0040000
6cd0.7988:   00007df554ee1000-00007df554eeffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554ef0000-00007df554f12fff 0x0002/0x0002 0x0040000
6cd0.7988:   00007df554f13000-00007df554f1ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007df554f20000-00007df556331fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007df556332000-00007df5563ebfff 0x0001/0x0001 0x0040000
6cd0.7988:   00007df5563ec000-00007df556cfbfff 0x0000/0x0001 0x0040000
6cd0.7988:   00007df556cfc000-00007df556cfcfff 0x0001/0x0001 0x0040000
6cd0.7988:   00007df556cfd000-00007ff52d744fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff52d745000-00007ff52d749fff 0x0002/0x0001 0x0040000
6cd0.7988:   00007ff52d74a000-00007ff54a201fff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff54a202000-00007ff54ffbefff 0x0001/0x0001 0x0040000
6cd0.7988:   00007ff54ffbf000-00007ff54ffc7fff 0x0002/0x0001 0x0040000
6cd0.7988:   00007ff54ffc8000-00007ff554f1ffff 0x0000/0x0001 0x0040000
6cd0.7988:   00007ff554f20000-00007ff62093ffff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007ff620940000-00007ff620940fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620941000-00007ff6209aafff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ab000-00007ff6209abfff 0x0040/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ac000-00007ff6209fefff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff6209ff000-00007ff620a0bfff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a0c000-00007ff620a53fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6cd0.7988:   00007ff620a54000-00007ffec27effff 0x0001/0x0000 0x0000000
6cd0.7988:  *00007ffec27f0000-00007ffec27f0fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec27f1000-00007ffec290cfff 0x0020/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec290d000-00007ffec2955fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2956000-00007ffec2959fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec295a000-00007ffec2961fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2962000-00007ffec2970fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2971000-00007ffec2971fff 0x0004/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2972000-00007ffec2974fff 0x0008/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec2975000-00007ffec29e7fff 0x0002/0x0080 0x1000000  \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6cd0.7988:   00007ffec29e8000-00007ffffffeffff 0x0001/0x0000 0x0000000
6cd0.7988: supR3HardNtChildPurify: Done after 813 ms and 1 fixes (loop #1).
6c5c.4de0: supR3HardenedVmProcessInit: uNtDllAddr=00007ffec27f0000 g_uNtVerCombined=0xa04a6500 (stack ~000000fe203fea10)
6c5c.4de0: ntdll.dll: timestamp 0x7ec9c15d (rc=VINF_SUCCESS)
6c5c.4de0: New simple heap: #1 000002ebd6a90000 LB 0x400000 (for 2064384 allocation)
6cd0.7988: supR3HardenedEarlyCompact: Removed heap 1 (0x0001b401190000 LB 0x400000)
6cd0.7988: supR3HardNtEnableThreadCreationEx:
6c5c.4de0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume7\Programs\VirtualBox'
6c5c.4de0: System32:  \Device\HarddiskVolume2\Windows\System32
6c5c.4de0: WinSxS:    \Device\HarddiskVolume2\Windows\WinSxS
6c5c.4de0: KnownDllPath: C:\Windows\System32
6c5c.4de0: supR3HardenedVmProcessInit: Opening vboxsup...
6c5c.4de0: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
6c5c.4de0: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
6c5c.4de0: Registered Dll notification callback with NTDLL.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfe80000 LB 0x002f6000 C:\Windows\System32\KERNELBASE.dll [fFlags=0x0]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\KernelBase.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\KernelBase.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1a70000 LB 0x000c2000 C:\Windows\System32\KERNEL32.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\KERNEL32.DLL'
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ff620940000 LB 0x00114000 D:\Programs\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
6c5c.4de0: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe
6c5c.4de0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffec2865c10 pvNtTerminateThread=00007ffec288dff0
6cd0.7988: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 98 ms.
6c5c.4de0: \SystemRoot\System32\ntdll.dll:
6c5c.4de0:     CreationTime:    2025-12-03T08:16:54.127987400Z
6c5c.4de0:     LastWriteTime:   2025-12-03T08:16:54.178622600Z
6c5c.4de0:     ChangeTime:      2025-12-28T00:15:23.544177800Z
6c5c.4de0:     FileAttributes:  0x20
6c5c.4de0:     Size:            0x1ef7b8
6c5c.4de0:     NT Headers:      0xe8
6c5c.4de0:     Timestamp:       0x7ec9c15d
6c5c.4de0:     Machine:         0x8664 - amd64
6c5c.4de0:     Timestamp:       0x7ec9c15d
6c5c.4de0:     Image Version:   10.0
6c5c.4de0:     SizeOfImage:     0x1f8000 (2064384)
6c5c.4de0:     Resource Dir:    0x186000 LB 0x70508
6c5c.4de0:     [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
6c5c.4de0:     [Raw version resource data: 0x1860f0 LB 0x380, codepage 0x0 (reserved 0x0)]
6c5c.4de0:     ProductName:     Microsoft® Windows® Operating System
6c5c.4de0:     ProductVersion:  10.0.19041.6456
6c5c.4de0:     FileVersion:     10.0.19041.6456 (WinBuild.160101.0800)
6c5c.4de0:     FileDescription: NT Layer DLL
6c5c.4de0: \SystemRoot\System32\kernel32.dll:
6c5c.4de0:     CreationTime:    2025-06-12T01:51:07.424621900Z
6c5c.4de0:     LastWriteTime:   2025-06-12T01:51:07.442620800Z
6c5c.4de0:     ChangeTime:      2025-12-28T00:15:23.387527600Z
6c5c.4de0:     FileAttributes:  0x20
6c5c.4de0:     Size:            0xbf568
6c5c.4de0:     NT Headers:      0xf8
6c5c.4de0:     Timestamp:       0xeee0fc1a
6c5c.4de0:     Machine:         0x8664 - amd64
6c5c.4de0:     Timestamp:       0xeee0fc1a
6c5c.4de0:     Image Version:   10.0
6c5c.4de0:     SizeOfImage:     0xc2000 (794624)
6c5c.4de0:     Resource Dir:    0xc0000 LB 0x520
6c5c.4de0:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
6c5c.4de0:     [Raw version resource data: 0xc00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
6c5c.4de0:     ProductName:     Microsoft® Windows® Operating System
6c5c.4de0:     ProductVersion:  10.0.19041.5915
6c5c.4de0:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
6c5c.4de0:     FileDescription: Windows NT BASE API Client DLL
6c5c.4de0: \SystemRoot\System32\KernelBase.dll:
6c5c.4de0:     CreationTime:    2025-12-03T08:16:55.078266800Z
6c5c.4de0:     LastWriteTime:   2025-12-03T08:16:55.191268200Z
6c5c.4de0:     ChangeTime:      2025-12-28T00:15:23.578934700Z
6c5c.4de0:     FileAttributes:  0x20
6c5c.4de0:     Size:            0x2f7a40
6c5c.4de0:     NT Headers:      0x100
6c5c.4de0:     Timestamp:       0x56511854
6c5c.4de0:     Machine:         0x8664 - amd64
6c5c.4de0:     Timestamp:       0x56511854
6c5c.4de0:     Image Version:   10.0
6c5c.4de0:     SizeOfImage:     0x2f6000 (3104768)
6c5c.4de0:     Resource Dir:    0x2cc000 LB 0x548
6c5c.4de0:     [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
6c5c.4de0:     [Raw version resource data: 0x2cc0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
6c5c.4de0:     ProductName:     Microsoft® Windows® Operating System
6c5c.4de0:     ProductVersion:  10.0.19041.6280
6c5c.4de0:     FileVersion:     10.0.19041.6280 (WinBuild.160101.0800)
6c5c.4de0:     FileDescription: Windows NT BASE API Client DLL
6c5c.4de0: \SystemRoot\System32\apisetschema.dll:
6c5c.4de0:     CreationTime:    2025-06-12T01:50:46.852431700Z
6c5c.4de0:     LastWriteTime:   2025-06-12T01:50:46.856431300Z
6c5c.4de0:     ChangeTime:      2025-12-03T08:17:47.931703400Z
6c5c.4de0:     FileAttributes:  0x20
6c5c.4de0:     Size:            0x1f9c8
6c5c.4de0:     NT Headers:      0xd0
6c5c.4de0:     Timestamp:       0x85f6b378
6c5c.4de0:     Machine:         0x8664 - amd64
6c5c.4de0:     Timestamp:       0x85f6b378
6c5c.4de0:     Image Version:   10.0
6c5c.4de0:     SizeOfImage:     0x20000 (131072)
6c5c.4de0:     Resource Dir:    0x1f000 LB 0x408
6c5c.4de0:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
6c5c.4de0:     [Raw version resource data: 0x1f060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
6c5c.4de0:     ProductName:     Microsoft® Windows® Operating System
6c5c.4de0:     ProductVersion:  10.0.19041.5915
6c5c.4de0:     FileVersion:     10.0.19041.5915 (WinBuild.160101.0800)
6c5c.4de0:     FileDescription: ApiSet Schema DLL
6c5c.4de0: NtOpenDirectoryObject failed on \Driver: 0xc0000022
6c5c.4de0: supR3HardenedWinFindAdversaries: 0x0
6c5c.4de0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume7\Programs\VirtualBox'
6c5c.4de0: Calling main()
6c5c.4de0: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
6c5c.4de0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume7\Programs\VirtualBox'
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe: Signature #1/2: info status: 24202
6c5c.4de0: '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe' has no imports
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe)
6c5c.4de0: SUPR3HardenedMain: Final process, opening VBoxDrv...
6c5c.4de0: supR3HardenedEarlyCompact: Removed heap 1 (0x0002ebd6a90000 LB 0x400000)
6c5c.4de0: supR3HardNtEnableThreadCreationEx:
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll: Signature #1/2: info status: 24202
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebe430000 LB 0x00005000 D:\Programs\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebe430000 'D:\Programs\VirtualBox\VBoxSupLib.DLL'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebe430000 'D:\Programs\VirtualBox\VBoxSupLib.DLL'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebe430000 'D:\Programs\VirtualBox\VBoxSupLib.DLL'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wintrust.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wintrust.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcrt.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1b40000 LB 0x0009e000 C:\Windows\System32\msvcrt.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0930000 LB 0x00120000 C:\Windows\System32\RPCRT4.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0410000 LB 0x00073000 C:\Windows\System32\Wintrust.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec05f0000 LB 0x00100000 C:\Windows\System32\ucrtbase.dll [fFlags=0x0]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ucrtbase.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ucrtbase.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0490000 LB 0x0015d000 C:\Windows\System32\CRYPT32.dll [fFlags=0x0]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\crypt32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msasn1.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msasn1.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfa60000 LB 0x00012000 C:\Windows\SYSTEM32\MSASN1.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\system32\Wintrust.dll'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcrypt.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcrypt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec06f0000 LB 0x00027000 C:\Windows\System32\bcrypt.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec06f0000 'C:\Windows\system32\bcrypt.dll'
6c5c.4de0: bcrypt.dll loaded at 00007ffec06f0000, BCryptOpenAlgorithmProvider at 00007ffec06f5a60, preloading providers:
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0180000 LB 0x00082000 C:\Windows\System32\bcryptprimitives.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0180000 'C:\Windows\system32\bcryptprimitives.dll'
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0 (hAlgo=000002ebd6fff290)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'MD4',0,0) -> 0x0 (hAlgo=000002ebd7001230)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'MD5',0,0) -> 0x0 (hAlgo=000002ebd7001550)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0 (hAlgo=000002ebd7001870)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'SHA256',0,0) -> 0x0 (hAlgo=000002ebd7001b90)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'SHA512',0,0) -> 0x0 (hAlgo=000002ebd7001eb0)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0 (hAlgo=000002ebd70031e0)
6c5c.4de0:     BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0 (hAlgo=000002ebd7003500)
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cryptsp.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptsp.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebf9f0000 LB 0x00018000 C:\Windows\SYSTEM32\CRYPTSP.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptsp.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'bcrypt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\rsaenh.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebed80000 LB 0x00038000 C:\Windows\system32\rsaenh.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cryptbase.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebf5d0000 LB 0x0000c000 C:\Windows\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\System32\WINTRUST.DLL'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\CRYPT32.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\CRYPT32.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1360000 LB 0x0001d000 C:\Windows\System32\imagehlp.dll [fFlags=0x0]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\imagehlp.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagehlp.dll
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1920000 LB 0x0009f000 C:\Windows\System32\sechost.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'bcrypt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sechost.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sechost.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\gpapi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gpapi.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebe600000 LB 0x00023000 C:\Windows\SYSTEM32\gpapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\profapi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\profapi.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfdb0000 LB 0x00024000 C:\Windows\SYSTEM32\profapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\profapi.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'crypt32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cryptnet.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'crypt32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' -> '\Device\HarddiskVolume2\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebc1c0000 LB 0x00031000 C:\Windows\System32\cryptnet.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x2 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1860000 LB 0x000b1000 C:\Windows\System32\advapi32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'sechost.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\advapi32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sechost.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' -> '\Device\HarddiskVolume2\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sechost.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000 pwszName=\SystemRoot\System32\ntdll.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=0CF12AA3B29D7188F4DC9C1E151BA1AD50268E1A
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\rpcrt4.dll (Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0930000 'C:\Windows\System32\rpcrt4.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\SystemRoot\System32\ntdll.dll'
6c5c.4de0: g_pfnWinVerifyTrust=00007ffec0413d10
6c5c.4de0: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wintrust.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\advapi32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\profapi.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gpapi.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sechost.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagehlp.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptbase.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cryptsp.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msasn1.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ucrtbase.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume7\Programs\VirtualBox\VBoxSupLib.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.exe'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\KernelBase.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\system32\crypt32.dll'
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xbbde687390e6bf00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x82de630e967eaf00 C=US, ST=California, L=Irvine, O=Blizzard Entertainment, OU=Battle.net, CN=Blizzard Battle.net Local Cert
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US, O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root Certificate Authority 2018
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp.
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root Certificate Authority 2018
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root Certificate Authority 2014
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x670683072a91b300 C=US, O=Microsoft Corporation, CN=Microsoft Identity Verification Root Certificate Authority 2020
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital Signature Trust Co., CN=DST Root CA X3
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x80d5e6f878f9bd00 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US, O=Equifax, OU=Equifax Secure Certificate Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xc6536f24d57ae723 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x3714f47324e8ad00 C=US, O=Internet Security Research Group, CN=ISRG Root X1
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xcb7d2ba3dd0ff900 C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com Root Certification Authority RSA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x4ef92ac43a0cd500 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x55230aaaee6a8a00 C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA Code Signing RSA Root CA 2021
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xf966ca73e8079500 OU=GlobalSign Root CA - R6, O=GlobalSign, CN=GlobalSign
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xbebef0d2217f0bfb C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x4dd6e14065368f00 C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com EV Root Certification Authority RSA R2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x298c3394be5bca00 C=US, O=Microsoft Corporation, CN=Microsoft RSA Root Certificate Authority 2017
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xb352b1523915d000 C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x362d8807333b600 C=US, O=DigiCert, Inc., CN=DigiCert CS RSA4096 Root G5
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00 O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xe87add30c52db600 C=BE, O=GlobalSign nv-sa, CN=GlobalSign Code Signing Root R45
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA
6c5c.4de0: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
6c5c.4de0: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=56
6c5c.4de0: SUPR3HardenedMain: Load Runtime...
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'ws2_32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ws2_32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcp140.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea3640000 LB 0x0002c000 C:\Windows\SYSTEM32\VCRUNTIME140.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe9c650000 LB 0x0000c000 C:\Windows\SYSTEM32\VCRUNTIME140_1.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe9aba0000 LB 0x0009c000 C:\Windows\SYSTEM32\MSVCP140.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1c60000 LB 0x0006b000 C:\Windows\System32\WS2_32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe81f60000 LB 0x006f7000 D:\Programs\VirtualBox\VBoxRT.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-string-l1-1-0'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-l1-2-1'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-datetime-l1-1-1'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-obsolete-l1-2-0'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxRT.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81f60000 'D:\Programs\VirtualBox\VBoxRT.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Wintrust.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\system32\Wintrust.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\system32\crypt32.dll'
6c5c.4de0: SUPR3HardenedMain: Load TrustedMain...
6c5c.2a38: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-appmodel-runtime-l1-1-2) -> 0x0, fPresent=1
6c5c.2a38: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-appmodel-runtime-l1-1-2 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.2a38: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcrt.dll'.
6c5c.2a38: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'rpcrt4.dll'.
6c5c.2a38: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll)
6c5c.2a38: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll
6c5c.2a38: supR3HardenedDllNotificationCallback: load   00007ffebe5e0000 LB 0x00012000 C:\Windows\SYSTEM32\kernel.appcore.dll [fFlags=0x0]
6c5c.2a38: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll [avoiding WinVerifyTrust]
6c5c.2a38: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebe5e0000 'api-ms-win-appmodel-runtime-l1-1-2'
6c5c.2a38: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.2a38: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.2a38: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.2a38: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.2a38: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.2a38: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.2a38: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.2a38: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.2a38: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\kernel.appcore.dll'
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'uicommon.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5widgetsvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winmm.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winmm.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\oleaut32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\combase.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #51 'combase.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ole32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\user32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\user32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'win32u.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\gdi32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: '\Device\HarddiskVolume2\Windows\System32\win32u.dll' has no imports
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\win32u.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\win32u.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\user32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #72 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #74 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shell32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dwmapi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uxtheme.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'uxtheme.dll' -> '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=22900 '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\uxtheme.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: Detected WinVerifyTrust recursion: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'mpr.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ws2_32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'winmm.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: Detected WinVerifyTrust recursion: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'd3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=22900 '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'glu32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\opengl32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\opengl32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'win32u.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dxgi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dxgi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'win32u.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\d3d11.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\d3d11.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'netapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\netapi32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\netapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume2\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\version.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'userenv.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' -> '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\userenv.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\userenv.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mpr.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mpr.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dxgi.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' -> '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: Detected WinVerifyTrust recursion: rc=22900 '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'opengl32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\glu32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\glu32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'd3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'opengl32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dxgi.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d11.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uicommon.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\uicommon.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\UICommon.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vcruntime140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'qt5widgetsvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'qt5helpvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\UICommon.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\UICommon.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/Imports: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\user32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5helpvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5helpvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5helpvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5HelpVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5sqlvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5HelpVBox.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5HelpVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll [redoing WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5sqlvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5sqlvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5sqlvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll: Signature #1/2: info status: 24202
6c5c.4de0: Detected WinVerifyTrust recursion: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vcruntime140.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000a01:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\UICommon.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5HelpVBox.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netapi32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d11.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dxgi.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\netutils.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\netutils.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\srvcli.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\srvcli.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea0070000 LB 0x0001d000 C:\Windows\SYSTEM32\MPR.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfd30000 LB 0x0002e000 C:\Windows\SYSTEM32\USERENV.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebe4e0000 LB 0x0000a000 C:\Windows\SYSTEM32\VERSION.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea4870000 LB 0x00019000 C:\Windows\SYSTEM32\NETAPI32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netapi32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1500000 LB 0x00354000 C:\Windows\System32\combase.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec03e0000 LB 0x00022000 C:\Windows\System32\win32u.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0770000 LB 0x0009d000 C:\Windows\System32\msvcp_win.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec21a0000 LB 0x001a1000 C:\Windows\System32\USER32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0210000 LB 0x00119000 C:\Windows\System32\gdi32full.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'win32u.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\gdi32full.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\gdi32full.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0b90000 LB 0x0002b000 C:\Windows\System32\GDI32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0a50000 LB 0x0012b000 C:\Windows\System32\ole32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0bc0000 LB 0x00770000 C:\Windows\System32\SHELL32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebc9e0000 LB 0x00027000 C:\Windows\SYSTEM32\WINMM.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebe500000 LB 0x00009000 C:\Windows\SYSTEM32\MSVCP140_1.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebf250000 LB 0x0000c000 C:\Windows\SYSTEM32\NETUTILS.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeacc70000 LB 0x00028000 C:\Windows\SYSTEM32\SRVCLI.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe94060000 LB 0x005c6000 D:\Programs\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5CoreVBox.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebe630000 LB 0x000f6000 C:\Windows\SYSTEM32\dxgi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dxgi.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeba5d0000 LB 0x00264000 C:\Windows\SYSTEM32\d3d11.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d11.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe66260000 LB 0x0002c000 C:\Windows\SYSTEM32\GLU32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\glu32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe66290000 LB 0x00128000 C:\Windows\SYSTEM32\OPENGL32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\opengl32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe88f20000 LB 0x0067c000 D:\Programs\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebd5b0000 LB 0x0009e000 C:\Windows\SYSTEM32\UxTheme.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebd990000 LB 0x0002e000 C:\Windows\SYSTEM32\dwmapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe93b10000 LB 0x00541000 D:\Programs\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea5fe0000 LB 0x00036000 D:\Programs\VirtualBox\Qt5SqlVBox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (24202) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea6410000 LB 0x0006a000 D:\Programs\VirtualBox\Qt5HelpVBox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5HelpVBox.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1430000 LB 0x000cd000 C:\Windows\System32\OLEAUT32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe82660000 LB 0x01bde000 D:\Programs\VirtualBox\UICommon.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\UICommon.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe96af0000 LB 0x00147000 D:\Programs\VirtualBox\VirtualBoxVM.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VirtualBoxVM.dll
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netutils.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\version.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'win32u.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\imm32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imm32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [redoing WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\win32u.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\win32u.dll [redoing WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\win32u.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\gdi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supR3HardenedScreenImage/Imports: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IMM32.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1330000 LB 0x0002f000 C:\Windows\System32\IMM32.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1330000 'C:\Windows\system32\IMM32.DLL'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netutils.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\version.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netutils.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\version.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: WinVerifyTrust not available, rescheduling \Device\HarddiskVolume2\Windows\System32\gdi32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0b90000 'C:\Windows\System32\gdi32.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netutils.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=24202 '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 24202 (was 24202) fWinVerifyTrust=0 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\glu32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\mpr.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\userenv.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\version.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dxgi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe96af0000 'D:\Programs\VirtualBox\VirtualBoxVM.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imm32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32full.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\srvcli.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\netutils.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 24202) fWinVerifyTrust=1 for '\Device\HarddiskVolume7\Programs\VirtualBox\Qt5SqlVBox.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000534 pwszName=\Device\HarddiskVolume2\Windows\System32\glu32.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F9BD657A46E4D2B551057409EEF78877E234338B
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\glu32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\glu32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\mpr.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\userenv.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\version.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\netapi32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\d3d11.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dxgi.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000584 pwszName=\Device\HarddiskVolume2\Windows\System32\opengl32.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8DD92ACE8EC50563AB3DC2A479CBC3BAD2D3D9F8
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\opengl32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000004cc pwszName=\Device\HarddiskVolume2\Windows\System32\uxtheme.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5CE86D61A74F808BE7CB93ACDAA146684F023EAE
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcp140_1.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\win32u.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\gdi32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\combase.dll'
6c5c.4de0: SUPR3HardenedMain: Calling TrustedMain (00007ffe96af1c90)...
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\platforms\qwindows.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'dwmapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'wtsapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'winmm.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'msvcp140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\platforms\qwindows.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wtsapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wtsapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wtsapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wtsapi32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\platforms\qwindows.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebcf40000 LB 0x00014000 C:\Windows\SYSTEM32\WTSAPI32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea5e70000 LB 0x00161000 D:\Programs\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\platforms\qwindows.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea5e70000 'D:\Programs\VirtualBox\platforms\qwindows.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebd5b0000 'C:\Windows\system32\uxtheme.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'C:\Windows\system32\user32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'combase.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\SHCore.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SHCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec1380000 LB 0x000ad000 C:\Windows\System32\SHCore.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1380000 'C:\Windows\system32\SHCore.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\system32\shell32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'wldp.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\windows.storage.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'oleaut32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wldp.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wldp.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebf660000 LB 0x0002b000 C:\Windows\SYSTEM32\Wldp.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wldp.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebdc80000 LB 0x007a5000 C:\Windows\SYSTEM32\windows.storage.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec2350000 LB 0x0005b000 C:\Windows\System32\shlwapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\shlwapi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\powrprof.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\powrprof.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfc50000 LB 0x0004b000 C:\Windows\SYSTEM32\powrprof.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\powrprof.dll [avoiding WinVerifyTrust]
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\umpdc.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\umpdc.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfc30000 LB 0x00012000 C:\Windows\SYSTEM32\UMPDC.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\umpdc.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wldp.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wldp.dll' -> '\Device\HarddiskVolume2\Windows\System32\wldp.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wldp.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\umpdc.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\powrprof.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wldp.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\windows.storage.dll'
6c5c.4de0: \Device\HarddiskVolume7\Programs\VirtualBox\styles\qwindowsvistastyle.dll: Signature #1/2: info status: 24202
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'qt5widgetsvbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'qt5guivbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'qt5corevbox.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'uxtheme.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'vcruntime140.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'vcruntime140_1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\styles\qwindowsvistastyle.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\styles\qwindowsvistastyle.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uxtheme.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'uxtheme.dll' -> '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5corevbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5corevbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5guivbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5guivbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5GuiVBox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'qt5widgetsvbox.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\qt5widgetsvbox.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\Qt5WidgetsVBox.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\styles\qwindowsvistastyle.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\styles\qwindowsvistastyle.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeae2a0000 LB 0x00026000 D:\Programs\VirtualBox\styles\qwindowsvistastyle.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\styles\qwindowsvistastyle.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeae2a0000 'D:\Programs\VirtualBox\styles\qwindowsvistastyle.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb3380000 LB 0x0029b000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'bcrypt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebd3d0000 LB 0x001b6000 C:\Windows\SYSTEM32\WindowsCodecs.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec19c0000 LB 0x000a9000 C:\Windows\System32\clbcatq.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\clbcatq.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\clbcatq.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\clbcatq.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'shcore.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\thumbcache.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\thumbcache.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe92f60000 LB 0x00067000 C:\Windows\System32\thumbcache.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\thumbcache.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe92f60000 'C:\Windows\System32\thumbcache.dll'
6c5c.4de0: '\Device\HarddiskVolume2\Windows\System32\imageres.dll' has no imports
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imageres.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000480 (hFile=00000000000006ec) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp110_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\policymanager.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\policymanager.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebee10000 LB 0x0008a000 C:\Windows\SYSTEM32\msvcp110_win.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebc240000 LB 0x000a1000 C:\Windows\SYSTEM32\policymanager.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\policymanager.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp110_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp110_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msvcp110_win.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\policymanager.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000728 pwszName=\Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E57DB24C441C536493607C84FB02B59BE1151BF9
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\imageres.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imageres.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WindowsCodecs.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\windowscodecs.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebd3d0000 'C:\Windows\system32\windowscodecs.dll'
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000078c (hFile=000000000000076c) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000704 (hFile=0000000000000770) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000704 (hFile=00000000000007d8) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.48f0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll: Signature #1/2: info status: 24202
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'advapi32.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'ole32.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'oleaut32.dll'.
6c5c.48f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll) WinVerifyTrust
6c5c.48f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.48f0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll
6c5c.48f0: supR3HardenedDllNotificationCallback: load   00007ffe88b40000 LB 0x003dc000 D:\Programs\VirtualBox\VBoxC.dll [fFlags=0x0]
6c5c.48f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe88b40000 'D:\Programs\VirtualBox\VBoxC.dll'
6c5c.48f0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxProxyStub.dll: Signature #1/2: info status: 24202
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'advapi32.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shlwapi.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ole32.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'oleaut32.dll'.
6c5c.48f0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
6c5c.48f0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
6c5c.48f0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxProxyStub.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.48f0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.48f0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxProxyStub.dll
6c5c.48f0: supR3HardenedDllNotificationCallback: load   00007ffea5d10000 LB 0x000dc000 D:\Programs\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
6c5c.48f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxProxyStub.dll
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea5d10000 'D:\Programs\VirtualBox\VBoxProxyStub.dll'
6c5c.48f0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.48f0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1430000 'C:\Windows\System32\oleaut32.dll'
6c5c.2ac0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxVMM.dll: Signature #1/2: info status: 24202
6c5c.2ac0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.2ac0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.2ac0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.2ac0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.2ac0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
6c5c.2ac0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxVMM.dll) WinVerifyTrust
6c5c.2ac0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxVMM.dll
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.2ac0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.2ac0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.2ac0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxVMM.dll
6c5c.2ac0: supR3HardenedDllNotificationCallback: load   00007ffe81a80000 LB 0x004d8000 D:\Programs\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
6c5c.2ac0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxVMM.dll
6c5c.2ac0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe81a80000 'D:\Programs\VirtualBox\VBoxVMM.DLL'
6c5c.4de0: '\Device\HarddiskVolume2\Windows\System32\tzres.dll' has no imports
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\tzres.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\tzres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000a88 (hFile=0000000000000a80) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\tzres.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000a80 (hFile=0000000000000a88) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000a84 pwszName=\Device\HarddiskVolume2\Windows\System32\tzres.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=81BC6EAAED86CFB4B3057D2BFCB133ACB51C2EFC
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\tzres.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\tzres.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'dwmapi.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\d3d9.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\d3d9.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dwmapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dwmapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\dwmapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dwmapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\d3d9.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d9.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe789d0000 LB 0x001d1000 C:\Windows\system32\d3d9.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d9.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe789d0000 'C:\Windows\system32\d3d9.dll'
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME for 0x684a19c3; retrying against current time: 0x6a2af51e.
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME (-23033) w/ timestamp=0x6a2af51e/now.
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume2\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb3080000 LB 0x000c2000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3080000 'C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msasn1.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msasn1.dll (Input=msasn1.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfa60000 'C:\Windows\System32\msasn1.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptbase.dll (Input=cryptbase.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebf5d0000 'C:\Windows\System32\cryptbase.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wldp.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wldp.dll (Input=wldp.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebf660000 'C:\Windows\System32\wldp.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\drvstore.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\drvstore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\drvstore.dll (Input=drvstore.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drvstore.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebbf10000 LB 0x00147000 C:\Windows\System32\drvstore.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drvstore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebbf10000 'C:\Windows\System32\drvstore.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'cfgmgr32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\devobj.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\devobj.dll (Input=devobj.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0720000 LB 0x0004e000 C:\Windows\System32\cfgmgr32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfaa0000 LB 0x00033000 C:\Windows\System32\devobj.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfaa0000 'C:\Windows\System32\devobj.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\wintrust.dll (Input=wintrust.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\System32\wintrust.dll'
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME for 0x684a1b6b; retrying against current time: 0x6a2af51f.
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME (-23033) w/ timestamp=0x6a2af51f/now.
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeaeef0000 LB 0x03ab3000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-string-l1-1-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-l1-2-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-datetime-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-obsolete-l1-2-0'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeaeef0000 'C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb4ad0000 LB 0x00363000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb4ad0000 'C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-string-l1-1-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-l1-2-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-datetime-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-obsolete-l1-2-0'
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME for 0x684a1a88; retrying against current time: 0x6a2af520.
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME (-23033) w/ timestamp=0x6a2af520/now.
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'winmm.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'powrprof.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'powrprof.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'powrprof.dll' -> '\Device\HarddiskVolume2\Windows\System32\powrprof.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\powrprof.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume2\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeac120000 LB 0x000dd000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeac120000 'C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll'
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME for 0x684a19b7; retrying against current time: 0x6a2af520.
6c5c.4de0: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll: Signature #2/3: VERR_CR_X509_CPV_NOT_VALID_AT_TIME (-23033) w/ timestamp=0x6a2af520/now.
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'version.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'winmm.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' -> '\Device\HarddiskVolume2\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winmm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume2\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe7f7f0000 LB 0x0228d000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\kernel32.dll (Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe7f7f0000 'C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0b90000 'C:\Windows\System32\gdi32.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffe7f7f0000 LB 0x0228d000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvd3dumx.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffeb4ad0000 LB 0x00363000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\Display.NvContainer\NvMessageBus.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffeaeef0000 LB 0x03ab3000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvgpucomp64.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffeac120000 LB 0x000dd000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\NvMemMapStoragex.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffebbf10000 LB 0x00147000 C:\Windows\System32\drvstore.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffebfaa0000 LB 0x00033000 C:\Windows\System32\devobj.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffec0720000 LB 0x0004e000 C:\Windows\System32\cfgmgr32.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffeb3080000 LB 0x000c2000 C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_13e0ffdc778a9096\nvldumdx.dll [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec0810000 LB 0x00115000 C:\Windows\System32\MSCTF.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #39 'imm32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msctf.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msctf.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\msctf.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b2c pwszName=\Device\HarddiskVolume2\Windows\System32\DataExchange.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A4DA1F962C9E63B820B3A3C3D62A801F6EF1AA0C
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\DataExchange.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'd3d11.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'dcomp.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DataExchange.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DataExchange.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' -> '\Device\HarddiskVolume2\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'win32u.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcp_win.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dcomp.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dcomp.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' -> '\Device\HarddiskVolume2\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d3d11.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' -> '\Device\HarddiskVolume2\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DataExchange.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dcomp.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebaf50000 LB 0x001e4000 C:\Windows\system32\dcomp.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dcomp.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea49a0000 LB 0x0003e000 C:\Windows\system32\dataexchange.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DataExchange.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea49a0000 'C:\Windows\system32\dataexchange.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #30 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #43 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #45 'msvcp_win.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb6860000 LB 0x00203000 C:\Windows\system32\twinapi.appcore.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\twinapi.appcore.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shcore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1380000 'C:\Windows\system32\Shcore.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000858 pwszName=\Device\HarddiskVolume2\Windows\System32\DWrite.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4025A7217883772D53770945E12B41912877C78B
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\DWrite.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DWrite.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DWrite.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\dwrite.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DWrite.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea49e0000 LB 0x0027f000 C:\Windows\system32\dwrite.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DWrite.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea49e0000 'C:\Windows\system32\dwrite.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0b90000 'C:\Windows\system32\gdi32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'coreuicomponents.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'coremessaging.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\TextInputFramework.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\TextInputFramework.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'coremessaging.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'shcore.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\CoreUIComponents.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\CoreUIComponents.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'ws2_32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntmarta.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntmarta.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'bcryptprimitives.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\WinTypes.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\WinTypes.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebefd0000 LB 0x00033000 C:\Windows\SYSTEM32\ntmarta.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebb9a0000 LB 0x000f2000 C:\Windows\System32\CoreMessaging.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebca10000 LB 0x00157000 C:\Windows\SYSTEM32\wintypes.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebb140000 LB 0x0035b000 C:\Windows\System32\CoreUIComponents.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\CoreUIComponents.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb2e10000 LB 0x000f9000 C:\Windows\SYSTEM32\textinputframework.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\TextInputFramework.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume2\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coremessaging.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' -> '\Device\HarddiskVolume2\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'coreuicomponents.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' -> '\Device\HarddiskVolume2\Windows\System32\coreuicomponents.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\CoreUIComponents.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\WinTypes.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ntmarta.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\CoreMessaging.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\CoreUIComponents.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\TextInputFramework.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-com-l1-1-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-com-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1500000 'api-ms-win-core-com-l1-1-0.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MSCTF.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0810000 'C:\Windows\System32\MSCTF.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0a50000 'C:\Windows\System32\ole32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1430000 'C:\Windows\System32\OLEAUT32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c38 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=3BDE779C324B1B2E91238C2A86E13264284D56B8
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ws2_32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'wbemcomn.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000bec pwszName=\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=10D4848489EBE5251FC06EBA39CD8C3F27FB5394
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb4e40000 LB 0x00090000 C:\Windows\SYSTEM32\wbemcomn.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb4f60000 LB 0x00011000 C:\Windows\system32\wbem\wbemprox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemprox.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb4f60000 'C:\Windows\system32\wbem\wbemprox.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000cb4 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=86AB79F51B3C103952EF93FB96F82884D552BCBD
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb3150000 LB 0x00014000 C:\Windows\system32\wbem\wbemsvc.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\wbemsvc.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3150000 'C:\Windows\system32\wbem\wbemsvc.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-l1-2-0.dll'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-obsolete-l1-1-0.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c68 pwszName=\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=06B9B6703DCDBF4F336FCEFB67E31C67BCEC08D5
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #20 'wbemcomn.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wbemcomn.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' -> '\Device\HarddiskVolume2\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbemcomn.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb36a0000 LB 0x0010c000 C:\Windows\system32\wbem\fastprox.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wbem\fastprox.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb36a0000 'C:\Windows\system32\wbem\fastprox.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d18 pwszName=\Device\HarddiskVolume2\Windows\System32\amsi.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=759C41732AEF7C0FEF4EB5854E70672674DBA3BB
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\amsi.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\amsi.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\amsi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\amsi.dll (Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\amsi.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea4850000 LB 0x0001f000 C:\Windows\System32\amsi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\amsi.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea4850000 'C:\Windows\System32\amsi.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOAV.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOAV.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOav.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOAV.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe55210000 LB 0x000a5000 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOav.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOAV.dll
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.4de0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-2) -> 0x0, fPresent=1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-2 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-2'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\version.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebe4e0000 'C:\Windows\system32\version.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe55210000 'C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\MpOav.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0a50000 'C:\Windows\system32\ole32.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ff0 pwszName=\Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4B50B89F4271B7629C9B57AB82D9029BB5B62B5E
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'rpcrt4.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'oleaut32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'ws2_32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'netsetupapi.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'setupapi.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'devrtl.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devrtl.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'devrtl.dll' -> '\Device\HarddiskVolume2\Windows\System32\devrtl.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001204 pwszName=\Device\HarddiskVolume2\Windows\System32\devrtl.dll
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FF763AC969A9780636A1BEEECDF11CA702F1C0AF
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\devrtl.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\devrtl.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\devrtl.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'rpcrt4.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'cfgmgr32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'bcrypt.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\setupapi.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netsetupapi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'netsetupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\netsetupapi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'cfgmgr32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' -> '\Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\NetSetupApi.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\NetSetupApi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupShim.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupApi.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffec0720000 LB 0x0004e000 C:\Windows\System32\cfgmgr32.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cfgmgr32.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffead880000 LB 0x00026000 C:\Windows\System32\NetSetupApi.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupApi.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffec1cd0000 LB 0x00470000 C:\Windows\System32\setupapi.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffead230000 LB 0x00014000 C:\Windows\System32\DEVRTL.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devrtl.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffea4d10000 LB 0x00078000 C:\Windows\System32\NetSetupShim.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupShim.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea4d10000 'C:\Windows\System32\NetSetupShim.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'nsi.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'winnsi.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\NetSetupEngine.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\NetSetupEngine.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winnsi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winnsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\winnsi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winnsi.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winnsi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' -> '\Device\HarddiskVolume2\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\System32\nsi.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll)
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\nsi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rpcrt4.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\nsi.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\NetSetupEngine.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupEngine.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winnsi.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffec24a0000 LB 0x00008000 C:\Windows\System32\NSI.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\nsi.dll [avoiding WinVerifyTrust]
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffebc100000 LB 0x0000b000 C:\Windows\SYSTEM32\WINNSI.DLL [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winnsi.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffe97300000 LB 0x000ca000 C:\Windows\System32\NetSetupEngine.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\NetSetupEngine.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe97300000 'C:\Windows\System32\NetSetupEngine.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\nsi.dll'
6c5c.59b8: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedClipboard.dll: Signature #1/2: info status: 24202
6c5c.59b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.59b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.59b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.59b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.59b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.59b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
6c5c.59b8: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'user32.dll'.
6c5c.59b8: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
6c5c.59b8: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedClipboard.dll
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.59b8: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.59b8: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.59b8: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedClipboard.dll
6c5c.59b8: supR3HardenedDllNotificationCallback: load   00007ffeb2fa0000 LB 0x00010000 D:\Programs\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
6c5c.59b8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedClipboard.dll
6c5c.59b8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb2fa0000 'D:\Programs\VirtualBox\VBoxSharedClipboard.DLL'
6c5c.318c: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDragAndDropSvc.dll: Signature #1/2: info status: 24202
6c5c.318c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.318c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\crypt32.dll
6c5c.318c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\crypt32.dll (Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.318c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.318c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.318c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.318c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.318c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
6c5c.318c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
6c5c.318c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDragAndDropSvc.dll
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.318c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.318c: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.318c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDragAndDropSvc.dll
6c5c.318c: supR3HardenedDllNotificationCallback: load   00007ffeb2f90000 LB 0x0000d000 D:\Programs\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
6c5c.318c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDragAndDropSvc.dll
6c5c.318c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb2f90000 'D:\Programs\VirtualBox\VBoxDragAndDropSvc.DLL'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Shell32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\system32\Shell32.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fdc pwszName=\Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4CA4F1229B961B8FFD1EBA163505C1387F7CFEAF
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll'
6c5c.bbb0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'vid.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vid.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vid.dll' -> '\Device\HarddiskVolume2\Windows\System32\vid.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\vid.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\vid.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\WinHvPlatform.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vid.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffe6d7b0000 LB 0x0001b000 C:\Windows\SYSTEM32\vid.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vid.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffea6380000 LB 0x00026000 C:\Windows\system32\WinHvPlatform.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\WinHvPlatform.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea6380000 'C:\Windows\system32\WinHvPlatform.dll'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vid.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\vid.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe6d7b0000 'C:\Windows\system32\vid.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntdll.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\NTDLL.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\system32\NTDLL.DLL'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1860000 'C:\Windows\System32\ADVAPI32.dll'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\rsaenh.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\rsaenh.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD.dll: Signature #1/2: info status: 24202
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxddu.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'vboxdd2.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'setupapi.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'iphlpapi.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iphlpapi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ws2_32.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxdd2.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxdd2.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll: Signature #1/2: info status: 24202
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vboxrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vcruntime140.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxddu.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxddu.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDDU.dll: Signature #1/2: info status: 24202
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'setupapi.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'advapi32.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxDDU.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDDU.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDDU.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffea5c90000 LB 0x00071000 D:\Programs\VirtualBox\VBoxDDU.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDDU.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffe80680000 LB 0x0085d000 D:\Programs\VirtualBox\VBoxDD2.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffebf140000 LB 0x0003b000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IPHLPAPI.DLL
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffe80ee0000 LB 0x00b9a000 D:\Programs\VirtualBox\VBoxDD.DLL [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe80ee0000 'D:\Programs\VirtualBox\VBoxDD.DLL'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxC.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe88b40000 'D:\Programs\VirtualBox\VBoxC.DLL'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxDD2.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe80680000 'D:\Programs\VirtualBox\VBoxDD2.DLL'
6c5c.5314: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedFolders.dll: Signature #1/2: info status: 24202
6c5c.5314: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.5314: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.5314: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.5314: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vboxrt.dll'.
6c5c.5314: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
6c5c.5314: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedFolders.dll
6c5c.5314: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.5314: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.5314: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.5314: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.5314: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.5314: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedFolders.dll
6c5c.5314: supR3HardenedDllNotificationCallback: load   00007ffeae510000 LB 0x00014000 D:\Programs\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
6c5c.5314: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxSharedFolders.dll
6c5c.5314: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeae510000 'D:\Programs\VirtualBox\VBoxSharedFolders.DLL'
6c5c.a6d0: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestControlSvc.dll: Signature #1/2: info status: 24202
6c5c.a6d0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.a6d0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.a6d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.a6d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.a6d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.a6d0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
6c5c.a6d0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
6c5c.a6d0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestControlSvc.dll
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.a6d0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.a6d0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.a6d0: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.a6d0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestControlSvc.dll
6c5c.a6d0: supR3HardenedDllNotificationCallback: load   00007ffeae330000 LB 0x0000c000 D:\Programs\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
6c5c.a6d0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestControlSvc.dll
6c5c.a6d0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeae330000 'D:\Programs\VirtualBox\VBoxGuestControlSvc.DLL'
6c5c.3698: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestPropSvc.dll: Signature #1/2: info status: 24202
6c5c.3698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.3698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.3698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'vcruntime140.dll'.
6c5c.3698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'vcruntime140_1.dll'.
6c5c.3698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'msvcp140.dll'.
6c5c.3698: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'vboxrt.dll'.
6c5c.3698: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
6c5c.3698: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestPropSvc.dll
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' -> '\Device\HarddiskVolume7\Programs\VirtualBox\vboxrt.dll' [rcNtRedir=0xc0150008]
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140_1.dll'...
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140_1.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140_1.dll' [rcNtRedir=0xc0150008]
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.3698: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.3698: supR3HardenedMonitor_LdrLoadDll: pName=D:\Programs\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.3698: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestPropSvc.dll
6c5c.3698: supR3HardenedDllNotificationCallback: load   00007ffeae320000 LB 0x0000d000 D:\Programs\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
6c5c.3698: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume7\Programs\VirtualBox\VBoxGuestPropSvc.dll
6c5c.3698: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeae320000 'D:\Programs\VirtualBox\VBoxGuestPropSvc.DLL'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'rpcrt4.dll'.
6c5c.bbb0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'devobj.dll'.
6c5c.bbb0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll) WinVerifyTrust
6c5c.bbb0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' -> '\Device\HarddiskVolume2\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.bbb0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDevApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
6c5c.bbb0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffebfaa0000 LB 0x00033000 C:\Windows\System32\DEVOBJ.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\devobj.dll
6c5c.bbb0: supR3HardenedDllNotificationCallback: load   00007ffebc6c0000 LB 0x00085000 C:\Windows\System32\MMDevApi.dll [fFlags=0x0]
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc6c0000 'C:\Windows\System32\MMDevApi.dll'
6c5c.bbb0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MMDEVAPI.DLL (Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.bbb0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc6c0000 'C:\Windows\System32\MMDEVAPI.DLL'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ole32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\ole32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0a50000 'C:\Windows\system32\ole32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\TextShaping.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\TextShaping.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea5660000 LB 0x000ac000 C:\Windows\SYSTEM32\TextShaping.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\TextShaping.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\System32\WINTRUST.DLL'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\CRYPT32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\TextShaping.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d40 pwszName=\Device\HarddiskVolume2\Windows\System32\comdlg32.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=4227B44C44DD928E5F7831651DB12897D54B3045
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\comdlg32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #55 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #56 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #57 'comctl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #58 'shell32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comdlg32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\comctl32.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\comctl32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\comdlg32.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb8c40000 LB 0x000b0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\COMCTL32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffec23b0000 LB 0x000da000 C:\Windows\System32\comdlg32.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comdlg32.dll
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\imm32.dll (Input=imm32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1330000 'C:\Windows\System32\imm32.dll'
6c5c.4de0: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll' [rescheduled]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec23b0000 'C:\Windows\System32\comdlg32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_792d7c952443c49a\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\apphelp.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\apphelp.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebc060000 LB 0x00094000 C:\Windows\SYSTEM32\apphelp.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\apphelp.dll [avoiding WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\apphelp.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\apphelp.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\System32\ntdll.dll'
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\apphelp.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\apphelp.dll' [rescheduled]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000155c pwszName=\Device\HarddiskVolume2\Windows\System32\apphelp.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=93FD68B3DB678CD550C0DD6721C2A806DB0D0C60
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0514~31bf3856ad364e35~amd64~~10.0.19041.6392.cat'; file='\Device\HarddiskVolume2\Windows\System32\apphelp.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\apphelp.dll'
6c5c.4de0: \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll: Owner is not trusted installer (01 05 00 00 00 00 00 05 15 00 00 00 c0 65 fb e1 03 9c d0 fe e1 07 bb 17 ec 03 00 00)
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> -5667 (\Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll)
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll: supHardenedWinVerifyImageByHandle: TrustedInstaller is not the owner of '\Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\propsys.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\propsys.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb9250000 LB 0x000f4000 C:\Windows\system32\propsys.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb9250000 'C:\Windows\system32\propsys.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=2 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=3 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=4 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=5 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=6 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001588 pwszName=\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C8C516548307BDABFF2F5F14AB0E16BFFA79B598
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #21 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'propsys.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\networkexplorer.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\NetworkExplorer.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb8db0000 LB 0x00017000 C:\Windows\system32\NetworkExplorer.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\networkexplorer.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb8db0000 'C:\Windows\system32\NetworkExplorer.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'oleaut32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\p9np.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\p9np.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\p9np.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\p9np.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea4400000 LB 0x00029000 C:\Windows\System32\p9np.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\p9np.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea4400000 'C:\Windows\System32\p9np.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000015c4 pwszName=\Device\HarddiskVolume2\Windows\System32\drprov.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B5E8AFCEA84545FA342A472D5F5A806CA77A8B00
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0317~31bf3856ad364e35~amd64~~10.0.19041.6157.cat'; file='\Device\HarddiskVolume2\Windows\System32\drprov.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winsta.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\drprov.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\drprov.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winsta.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'winsta.dll' -> '\Device\HarddiskVolume2\Windows\System32\winsta.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winsta.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winsta.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\drprov.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winsta.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfbc0000 LB 0x00063000 C:\Windows\System32\WINSTA.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winsta.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea43f0000 LB 0x0000b000 C:\Windows\System32\drprov.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43f0000 'C:\Windows\System32\drprov.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000015e4 pwszName=\Device\HarddiskVolume2\Windows\System32\ntlanman.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=1F86A6B7D534E69769CC2263C8EEEB61738CECD6
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\ntlanman.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ntlanman.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntlanman.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea43d0000 LB 0x0001f000 C:\Windows\System32\ntlanman.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43d0000 'C:\Windows\System32\ntlanman.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000012fc pwszName=\Device\HarddiskVolume2\Windows\System32\davclnt.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=01C091BC8569982062B168F93B62E2B52A2C6C3A
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package06~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\davclnt.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'davhlpr.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\davclnt.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\davclnt.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'davhlpr.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'davhlpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\davhlpr.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001540 pwszName=\Device\HarddiskVolume2\Windows\System32\davhlpr.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=20503087ED843D871970E4A6D7E3C8437335E06D
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\davhlpr.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\davhlpr.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\davclnt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea43a0000 LB 0x0000d000 C:\Windows\System32\DAVHLPR.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davhlpr.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea43b0000 LB 0x0001e000 C:\Windows\System32\davclnt.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43b0000 'C:\Windows\System32\davclnt.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\windows.storage.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebdc80000 'C:\Windows\system32\windows.storage.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\dui70.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dui70.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe89cb0000 LB 0x001b4000 C:\Windows\System32\DUI70.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\dui70.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000160c pwszName=\Device\HarddiskVolume2\Windows\System32\dui70.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9CFC731A5A45D54915A1BDA5D5307DDBE3731FF5
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\dui70.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\dui70.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\Comctl32.dll (Input=Comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\Comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'gdi32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\duser.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\duser.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe6bed0000 LB 0x00095000 C:\Windows\System32\DUser.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\duser.dll [avoiding WinVerifyTrust]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\duser.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\duser.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\System32\ntdll.dll'
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\duser.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\duser.dll' [rescheduled]
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\duser.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\duser.dll' [rescheduled]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\user32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\user32.dll (Input=user32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'C:\Windows\System32\user32.dll'
6c5c.4de0: Detected loader lock ownership: rc=22900 '\Device\HarddiskVolume2\Windows\System32\duser.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 22900 (was 22900) fWinVerifyTrust=0 for '\Device\HarddiskVolume2\Windows\System32\duser.dll' [rescheduled]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001630 pwszName=\Device\HarddiskVolume2\Windows\System32\duser.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=95957C6FD4510838C96C43D88A65D2B517ECD887
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\duser.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\duser.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\duser.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DUser.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe6bed0000 'C:\Windows\System32\DUser.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'C:\Windows\System32\user32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\system32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'oleaut32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\edputil.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\edputil.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffead940000 LB 0x00024000 C:\Windows\SYSTEM32\edputil.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\edputil.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001668 pwszName=\Device\HarddiskVolume2\Windows\System32\edputil.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F109CB0227A8CBFBCD38E24501A137894A1B5AE5
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\edputil.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\edputil.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001638 pwszName=\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E28DAA746E83AE56C88D5E0FDDF0BB43712EDB80
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shcore.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'advapi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'imm32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'user32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #51 'd2d1.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd2d1.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'd2d1.dll' -> '\Device\HarddiskVolume2\Windows\System32\d2d1.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\d2d1.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\d2d1.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' -> '\Device\HarddiskVolume2\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imm32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\advapi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\explorerframe.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d2d1.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeba840000 LB 0x005c0000 C:\Windows\system32\d2d1.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\d2d1.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe92d00000 LB 0x00258000 C:\Windows\system32\explorerframe.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe92d00000 'C:\Windows\system32\explorerframe.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001440 (hFile=0000000000001010) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001440 (hFile=0000000000001114) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001440 (hFile=0000000000001010) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000152c pwszName=\Device\HarddiskVolume2\Windows\System32\msftedit.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8372D5F338DA287A973A3067A87A4E7E2D485B26
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\msftedit.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'oleaut32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msftedit.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msftedit.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\MsftEdit.dll (Input=MsftEdit.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msftedit.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe89600000 LB 0x0034c000 C:\Windows\System32\MsftEdit.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msftedit.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe89600000 'C:\Windows\System32\MsftEdit.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000dac pwszName=\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B61F1023B11C06E4A2296864D17425D209FE8CC1
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #35 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'bcp47langs.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #48 'bcp47mrm.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcp47mrm.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcp47mrm.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcp47mrm.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\BCP47mrm.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\BCP47mrm.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcp47langs.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcp47langs.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcp47langs.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\Windows.Globalization.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47mrm.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb3a10000 LB 0x0005b000 C:\Windows\System32\Bcp47Langs.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47Langs.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb37b0000 LB 0x0002d000 C:\Windows\System32\bcp47mrm.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\BCP47mrm.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea6480000 LB 0x001a6000 C:\Windows\System32\Windows.Globalization.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Globalization.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea6480000 'C:\Windows\System32\Windows.Globalization.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\globinputhost.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\globinputhost.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe895a0000 LB 0x00025000 C:\Windows\SYSTEM32\globinputhost.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\globinputhost.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001600 pwszName=\Device\HarddiskVolume2\Windows\System32\globinputhost.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6CE9C5D51B629CBB0169DE5A19170403ABEA1FE2
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package051021~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\globinputhost.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\globinputhost.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0a50000 'C:\Windows\System32\ole32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0810000 'C:\Windows\System32\msctf.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\msctf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0810000 'C:\Windows\system32\msctf.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe876c0000 LB 0x000a9000 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe876c0000 'C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'shcore.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'sspicli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #38 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #40 'propsys.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #41 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\ntshrui.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ntshrui.dll
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sspicli.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sspicli.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebfd60000 LB 0x00032000 C:\Windows\SYSTEM32\SspiCli.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe8fb70000 LB 0x0007d000 C:\Windows\SYSTEM32\ntshrui.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\ntshrui.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'sspicli.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'sspicli.dll' -> '\Device\HarddiskVolume2\Windows\System32\sspicli.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sspicli.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000169c pwszName=\Device\HarddiskVolume2\Windows\System32\ntshrui.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6A8DC5D092AB5CE7620F6DC8009FC2652E2459DE
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\ntshrui.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\ntshrui.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001704 pwszName=\Device\HarddiskVolume2\Windows\System32\cscapi.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=04025BA44D9D3DABC8ADD59B06311AE136DFF585
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\cscapi.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\cscapi.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cscapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cscapi.dll (Input=cscapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebc2f0000 LB 0x00012000 C:\Windows\System32\cscapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc2f0000 'C:\Windows\System32\cscapi.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\System32\ntdll.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\xmllite.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\xmllite.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\xmllite.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffebd0b0000 LB 0x00036000 C:\Windows\system32\xmllite.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebd0b0000 'C:\Windows\system32\xmllite.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\oleacc.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\oleacc.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb9570000 LB 0x00066000 C:\Windows\system32\OLEACC.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\oleacc.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000017d0 pwszName=\Device\HarddiskVolume2\Windows\System32\oleacc.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CABC95B3A9CC6F150324D7EA803A622C285C3E40
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\oleacc.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\oleacc.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1430000 'C:\Windows\System32\OLEAUT32.DLL'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000017dc pwszName=\Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=18F500D0D1381D45F1CEFE30AAA2B4D578DD791B
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'propsys.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\uiautomationcore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe8dd70000 LB 0x002f4000 C:\Windows\System32\uiautomationcore.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8dd70000 'C:\Windows\System32\uiautomationcore.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\UIAutomationCore.dll (Input=UIAutomationCore.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8dd70000 'C:\Windows\System32\UIAutomationCore.dll'
6c5c.92e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\UIAutomationCore.dll
6c5c.92e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\SYSTEM32\UIAutomationCore.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.92e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8dd70000 'C:\Windows\SYSTEM32\UIAutomationCore.dll'
6c5c.92e4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\sxs.dll)
6c5c.92e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\sxs.dll
6c5c.92e4: supR3HardenedDllNotificationCallback: load   00007ffebfb10000 LB 0x000a2000 C:\Windows\SYSTEM32\sxs.dll [fFlags=0x0]
6c5c.92e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sxs.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\sxs.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000022c pwszName=\Device\HarddiskVolume2\Windows\System32\atlthunk.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=EFF941C9D8EBE0A84A571E11DEA6355C38DEB2D0
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\atlthunk.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\atlthunk.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\atlthunk.dll (Input=atlthunk.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffead0a0000 LB 0x0000d000 C:\Windows\System32\atlthunk.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\atlthunk.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffead0a0000 'C:\Windows\System32\atlthunk.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleacc.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleacc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb9570000 'C:\Windows\System32\oleacc.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'shcore.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\StructuredQuery.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea54b0000 LB 0x000a6000 C:\Windows\System32\StructuredQuery.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\StructuredQuery.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea54b0000 'C:\Windows\System32\StructuredQuery.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000012bc pwszName=\Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=5B4BA38CA3E211EF0FDB745BCC3A695E1A7EDE14
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'windows.storage.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'shcore.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'oleaut32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SHCore.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'windows.storage.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'windows.storage.dll' -> '\Device\HarddiskVolume2\Windows\System32\windows.storage.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcp_win.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\Windows.FileExplorer.Common.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe88270000 LB 0x00064000 C:\Windows\System32\Windows.FileExplorer.Common.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.FileExplorer.Common.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe88270000 'C:\Windows\System32\Windows.FileExplorer.Common.dll'
6c5c.31b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.31b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.31b4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.31b4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'rpcrt4.dll'.
6c5c.31b4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\Windows.StateRepositoryPS.dll) WinVerifyTrust
6c5c.31b4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Windows.StateRepositoryPS.dll
6c5c.31b4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.31b4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.31b4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.31b4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.31b4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\\Windows.StateRepositoryPS.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #46 'srvcli.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #47 'netutils.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\iertutil.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\iertutil.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeacca0000 LB 0x002bf000 C:\Windows\System32\iertutil.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\iertutil.dll [avoiding WinVerifyTrust]
6c5c.31b4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.StateRepositoryPS.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netutils.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'netutils.dll' -> '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'srvcli.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'srvcli.dll' -> '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.31b4: supR3HardenedDllNotificationCallback: load   00007ffea41b0000 LB 0x00146000 C:\Windows\System32\Windows.StateRepositoryPS.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.31b4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.StateRepositoryPS.dll
6c5c.31b4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea41b0000 'C:\Windows\System32\\Windows.StateRepositoryPS.dll'
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c44 pwszName=\Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=8A3EA801F6C6EA208CDA5467F8BF23FC48155DE3
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll'
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'shcore.dll'.
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'windows.storage.dll'.
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll) WinVerifyTrust
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'windows.storage.dll'...
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: 'windows.storage.dll' -> '\Device\HarddiskVolume2\Windows\System32\windows.storage.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Windows.Storage.Search.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll
6c5c.1878: supR3HardenedDllNotificationCallback: load   00007ffea5170000 LB 0x000c7000 C:\Windows\system32\Windows.Storage.Search.dll [fFlags=0x0]
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\Windows.Storage.Search.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea5170000 'C:\Windows\system32\Windows.Storage.Search.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\iertutil.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec21a0000 'C:\Windows\System32\user32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\xmllite.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\xmllite.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebd0b0000 'C:\Windows\system32\xmllite.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000780 (hFile=0000000000000aa0) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000014d4 pwszName=\Device\HarddiskVolume2\Windows\System32\IconCodecService.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=7B2FF1B43A1A2F6E33352EBF03B1648FBDF2CE26
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\IconCodecService.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\IconCodecService.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\IconCodecService.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\IconCodecService.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IconCodecService.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea59e0000 LB 0x00009000 C:\Windows\system32\IconCodecService.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\IconCodecService.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea59e0000 'C:\Windows\system32\IconCodecService.dll'
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\imageres.dll
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000264 (hFile=00000000000002a8) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000280 (hFile=00000000000002c8) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedDllNotificationCallback: load   00007ffec1be0000 LB 0x00079000 C:\Windows\System32\coml2.dll [fFlags=0x0]
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Windows.Storage.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebdc80000 'C:\Windows\system32\Windows.Storage.dll'
6c5c.1af0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\Windows.Storage.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebdc80000 'C:\Windows\system32\Windows.Storage.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\p9np.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\p9np.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea4400000 'C:\Windows\System32\p9np.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\drprov.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\drprov.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43f0000 'C:\Windows\System32\drprov.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntdll.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec27f0000 'C:\Windows\System32\ntdll.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ntlanman.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ntlanman.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43d0000 'C:\Windows\System32\ntlanman.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #34 'bcryptprimitives.dll'.
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\coml2.dll)
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\coml2.dll
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcryptprimitives.dll'...
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcryptprimitives.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wkscli.dll)
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wkscli.dll
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffebeea0000 LB 0x00019000 C:\Windows\System32\wkscli.dll [fFlags=0x0]
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wkscli.dll [avoiding WinVerifyTrust]
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.1878: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\coml2.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\windows.storage.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\windows.storage.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebdc80000 'C:\Windows\System32\windows.storage.dll'
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\linkinfo.dll)
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\linkinfo.dll
6c5c.1878: supR3HardenedDllNotificationCallback: load   00007ffeb29f0000 LB 0x0000d000 C:\Windows\SYSTEM32\LINKINFO.dll [fFlags=0x0]
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\linkinfo.dll [avoiding WinVerifyTrust]
6c5c.812c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wkscli.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c40 pwszName=\Device\HarddiskVolume2\Windows\System32\linkinfo.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=CA6F3CD4F40ACD27FE1E1EA36943F08226BAE6DA
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\linkinfo.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\linkinfo.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cscapi.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cscapi.dll (Input=cscapi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc2f0000 'C:\Windows\System32\cscapi.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\davclnt.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\davclnt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea43b0000 'C:\Windows\System32\davclnt.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=7 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=8 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=16 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001858 pwszName=\Device\HarddiskVolume2\Windows\System32\dlnashext.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebd708ab90
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd708ab90
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F1375E2C1CC54ACECF802B1E563D18FD958E2614
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000184c pwszName=\Device\HarddiskVolume2\Windows\System32\twinapi.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebdc1732c0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1732c0
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=C634ADC8C7F48106163FF5A5A0B7DBA116C5DEBB
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=32 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\twinapi.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'combase.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #31 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\twinapi.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\twinapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\combase.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\twinapi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea6650000 LB 0x000a8000 C:\Windows\System32\twinapi.dll [fFlags=0x0]
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\twinapi.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea6650000 'C:\Windows\System32\twinapi.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.4355.cat'; file='\Device\HarddiskVolume2\Windows\System32\dlnashext.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'oleaut32.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\dlnashext.dll) WinVerifyTrust
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\dlnashext.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffe910e0000 LB 0x00056000 C:\Windows\System32\dlnashext.dll [fFlags=0x0]
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\dlnashext.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe910e0000 'C:\Windows\System32\dlnashext.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000147c pwszName=\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1732c0
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1732c0
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=ADDFC71CD3EDC81F74EC57F12D5785DD31ADF743
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll'
6c5c.a2ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.a2ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.a2ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'rpcrt4.dll'.
6c5c.a2ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll) WinVerifyTrust
6c5c.a2ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\PlayToDevice.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.a2ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
6c5c.a2ec: supR3HardenedDllNotificationCallback: load   00007ffea5e00000 LB 0x00064000 C:\Windows\System32\PlayToDevice.dll [fFlags=0x0]
6c5c.a2ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PlayToDevice.dll
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffea5e00000 'C:\Windows\System32\PlayToDevice.dll'
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.a2ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.a2ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll) WinVerifyTrust
6c5c.a2ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.a2ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.a2ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msvcrt.dll
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\DevDispItemProvider.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.a2ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
6c5c.a2ec: supR3HardenedDllNotificationCallback: load   00007ffeac5b0000 LB 0x00020000 C:\Windows\System32\DevDispItemProvider.dll [fFlags=0x0]
6c5c.a2ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\DevDispItemProvider.dll
6c5c.a2ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeac5b0000 'C:\Windows\System32\DevDispItemProvider.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001854 pwszName=\Device\HarddiskVolume2\Windows\System32\wpdshext.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1732c0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1732c0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=FA327E13D7EBDA8D81529A79E302FE2B75797863
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.19041.5848.cat'; file='\Device\HarddiskVolume2\Windows\System32\wpdshext.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'gdi32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'shlwapi.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'user32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'gdiplus.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'shcore.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\wpdshext.dll) WinVerifyTrust
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdiplus.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdiplus.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdiplus.dll' [rcNtRedir=0x0]
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001808 pwszName=\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1732c0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1732c0
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000017e0 pwszName=\Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebdc6fdca0
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc6fdca0
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000006cc pwszName=\Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebdc1633a0
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.1818: \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll: Owner is administrators group.
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09E74CFAF20EF6E59CB79B7E39E3E99AEB2B7A6A
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09E74CFAF20EF6E59CB79B7E39E3E99AEB2B7A6A
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptnet.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\cryptnet.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc1c0000 'C:\Windows\System32\cryptnet.dll'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A86C38F8C483B88D9352AD27E882C59C23E05F14
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\urlmon.dll'
6c5c.1af0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.1af0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1af0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'iertutil.dll'.
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\urlmon.dll'
6c5c.1878: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000010e4 pwszName=\Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'iertutil.dll'.
6c5c.1af0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'srvcli.dll'.
6c5c.1af0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'netutils.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shell32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'ole32.dll'.
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\urlmon.dll) WinVerifyTrust
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'oleaut32.dll'.
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shlwapi.dll'.
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'srvcli.dll'.
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'netutils.dll'.
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.1818: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll) WinVerifyTrust
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\urlmon.dll) WinVerifyTrust
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\urlmon.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netutils.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'netutils.dll' -> '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'srvcli.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'srvcli.dll' -> '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netutils.dll'...
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'netutils.dll' -> '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'srvcli.dll'...
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'srvcli.dll' -> '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iertutil.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'iertutil.dll' -> '\Device\HarddiskVolume2\Windows\System32\iertutil.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\iertutil.dll
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedDllNotificationCallback: load   00007ffeac200000 LB 0x001f2000 C:\Windows\System32\urlmon.dll [fFlags=0x0]
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iertutil.dll'...
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'iertutil.dll' -> '\Device\HarddiskVolume2\Windows\System32\iertutil.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\iertutil.dll
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\urlmon.dll
6c5c.1af0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\urlmon.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeac200000 'C:\Windows\System32\urlmon.dll'
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1818: supR3HardenedDllNotificationCallback: load   00007ffe8ee70000 LB 0x000c2000 C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [fFlags=0x0]
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-fibers-l1-1-1) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-fibers-l1-1-1'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-synch-l1-2-0) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-synch-l1-2-0'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\sspicli.dll
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\sspicli.dll (Input=sspicli.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfd60000 'C:\Windows\System32\sspicli.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1a70000 'C:\Windows\System32\kernel32.dll'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-string-l1-1-0) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-string-l1-1-0'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-l1-2-1) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-l1-2-1'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-datetime-l1-1-1) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-datetime-l1-1-1'
6c5c.1818: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-localization-obsolete-l1-2-0) -> 0x0, fPresent=1
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'api-ms-win-core-localization-obsolete-l1-2-0'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ee70000 'C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll'
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeac200000 'C:\Windows\System32\urlmon.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ee70000 'C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll'
6c5c.1af0: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-WIN-CORE-URL-L1-1-0.DLL) -> 0x0, fPresent=1
6c5c.1878: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-WIN-CORE-URL-L1-1-0.DLL) -> 0x0, fPresent=1
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-CORE-URL-L1-1-0.DLL (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-WIN-CORE-URL-L1-1-0.DLL (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'API-MS-WIN-CORE-URL-L1-1-0.DLL'
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebfe80000 'API-MS-WIN-CORE-URL-L1-1-0.DLL'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ee70000 'C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ee70000 'C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll'
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001b00 pwszName=\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebdd602f70
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdd602f70
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Images Many.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Images Many.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Images Many.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Text.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Text.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Text.ico
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=D1B3D02E9317FEC4F6A8A2DC3B8B6D8A24033540
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'user32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'gdi32.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\GdiPlus.dll) WinVerifyTrust
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\GdiPlus.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shlwapi.dll
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\Community\FamousPeople\MaxHeadroom.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\Community\FamousPeople\MaxHeadroom.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\Community\FamousPeople\MaxHeadroom.ico
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\wpdshext.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Tomorrow\Repair.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Repair.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Repair.ico
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #26 'user32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'gdi32.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll)
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll'
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'user32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'oleaut32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'advapi32.dll'.
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffeba3d0000 LB 0x001a8000 C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\gdiplus.dll [fFlags=0x0]
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shell32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'propsys.dll'.
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll [avoiding WinVerifyTrust]
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shlwapi.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'comctl32.dll'.
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffe84930000 LB 0x000a1000 C:\Windows\system32\wpdshext.dll [fFlags=0x0]
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'setupapi.dll'.
6c5c.1818: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\EhStorShell.dll) WinVerifyTrust
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wpdshext.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'comctl32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'comctl32.dll' -> '\Device\HarddiskVolume2\Windows\System32\comctl32.dll' [rcNtRedir=0x0]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe84930000 'C:\Windows\system32\wpdshext.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001bb0 pwszName=\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1732c0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1732c0
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\comctl32.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorShell.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\incomingFiles.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\incomingFiles.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\incomingFiles.ico
6c5c.1818: supR3HardenedDllNotificationCallback: load   00007ffe8edb0000 LB 0x00037000 C:\Windows\System32\EhStorShell.dll [fFlags=0x0]
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8edb0000 'C:\Windows\System32\EhStorShell.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorShell.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorShell.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8edb0000 'C:\Windows\System32\EhStorShell.dll'
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=09E74CFAF20EF6E59CB79B7E39E3E99AEB2B7A6A
6c5c.1818: \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll: Owner is administrators group.
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Ridiculous Tie.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Ridiculous Tie.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Ridiculous Tie.ico
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Tomorrow\File-Image.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\File-Image.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Tomorrow\File-Image.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Incoming Sluggi Notiss.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Incoming Sluggi Notiss.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Incoming Sluggi Notiss.ico
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\urlmon.dll'
6c5c.b45c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b45c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.b45c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'iertutil.dll'.
6c5c.b45c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #49 'srvcli.dll'.
6c5c.b45c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #50 'netutils.dll'.
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\urlmon.dll) WinVerifyTrust
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netutils.dll'...
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: 'netutils.dll' -> '\Device\HarddiskVolume2\Windows\System32\netutils.dll' [rcNtRedir=0xc0150008]
6c5c.b45c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netutils.dll
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'srvcli.dll'...
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: 'srvcli.dll' -> '\Device\HarddiskVolume2\Windows\System32\srvcli.dll' [rcNtRedir=0xc0150008]
6c5c.b45c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\srvcli.dll
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iertutil.dll'...
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: 'iertutil.dll' -> '\Device\HarddiskVolume2\Windows\System32\iertutil.dll' [rcNtRedir=0xc0150008]
6c5c.b45c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\iertutil.dll
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.b45c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\urlmon.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeac200000 'C:\Windows\System32\urlmon.dll'
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\Ntv.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\Ntv.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\Ntv.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Graph.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Graph.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Graph.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\SinglePhotoCD.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\SinglePhotoCD.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\SinglePhotoCD.ico
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Tomorrow\Wanisin.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Wanisin.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Wanisin.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\NeXT-jewel.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\NeXT-jewel.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\NeXT-jewel.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Star.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Star.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Image Star.ico
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Descent\Floppy Diskette.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Descent\Floppy Diskette.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Descent\Floppy Diskette.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\ChessApp.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\ChessApp.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\ChessApp.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Tomorrow\Tshayea.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Tshayea.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Tshayea.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=A86C38F8C483B88D9352AD27E882C59C23E05F14
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume7\Desktop\Lethe\Icons\Lethe Clam High Contrast Mixed.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume7\Desktop\Lethe\Icons\Lethe Clam High Contrast Mixed.ico: 
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Desktop\Lethe\Icons\Lethe Clam High Contrast Mixed.ico
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Text.ico [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Text.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Comet.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Comet.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Comet.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\GdiPlus.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\Comctl32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\Comctl32.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001758 pwszName=\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sword.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sword.ico: 
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\File Palette 2.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Palette 2.ico: 
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Multimedia.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Multimedia.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sword.ico
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\File Palette 2.ico
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Multimedia.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=266995BE29C6F580A35BBA47CC4CB717A9003850
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Font.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Font.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Font.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Flame Green.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Flame Green.ico: 
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\InterfaceBuilder_nibpalette.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\InterfaceBuilder_nibpalette.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Flame Green.ico
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\InterfaceBuilder_nibpalette.ico
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Note.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Note.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Note.ico
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.19041.5848.cat'; file='\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'rpcrt4.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll) WinVerifyTrust
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\PortableDeviceApi.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Descent\Books 2.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Descent\Books 2.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Descent\Books 2.ico
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffebcfd0000 LB 0x000a3000 C:\Windows\System32\PortableDeviceApi.dll [fFlags=0x0]
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\PortableDeviceApi.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebcfd0000 'C:\Windows\System32\PortableDeviceApi.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\BattleTech.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\BattleTech.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\BattleTech.ico
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001d50 pwszName=\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9EF247319B400355C08CB19C706438DAFA6DBDBF
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Descent\Books 2.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Descent\Books 2.ico
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=2 \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico
6c5c.1af0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001b3c (hFile=0000000000001974) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=3 \Device\HarddiskVolume2\Windows\Icons\NeXT\net.ico
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Descent\Workstation.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Descent\Workstation.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Descent\Workstation.ico
6c5c.1af0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000006d8 (hFile=0000000000001974) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Descent\Workstation.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Descent\Workstation.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\home.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\home.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\home.ico
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0310~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll'
6c5c.812c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'advapi32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'oleaut32.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'setupapi.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'shlwapi.dll'.
6c5c.812c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'wtsapi32.dll'.
6c5c.812c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll) WinVerifyTrust
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'wtsapi32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'wtsapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\wtsapi32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wtsapi32.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'setupapi.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\setupapi.dll
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.812c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\EhStorAPI.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
6c5c.812c: supR3HardenedDllNotificationCallback: load   00007ffeb2fb0000 LB 0x00026000 C:\Windows\System32\EhStorAPI.dll [fFlags=0x0]
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\EhStorAPI.dll
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb2fb0000 'C:\Windows\System32\EhStorAPI.dll'
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\home.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\home.ico
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.812c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=64 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.1878: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'oleaut32.dll'.
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wsl.exe)
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\wsl.exe
6c5c.1878: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000019c4 (hFile=0000000000001cf4) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.b45c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #42 'oleaut32.dll'.
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\wsl.exe)
6c5c.b45c: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 000000000000196c (hFile=0000000000001bf8) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001d08 pwszName=\Device\HarddiskVolume2\Windows\System32\wsl.exe
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=ABF232926E65084DD7E15C48835E36C1DB3D9583
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\wsl.exe [avoiding WinVerifyTrust]
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\wsl.exe [avoiding WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001dcc (hFile=0000000000001dc0) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.b45c: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001dc0 (hFile=0000000000001bf8) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'shlwapi.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'user32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'oleaut32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'uxtheme.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'mpr.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'netapi32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shell32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'msvcp140.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'advapi32.dll'.
6c5c.1818: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'vcruntime140.dll'.
6c5c.1818: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll) WinVerifyTrust
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vcruntime140.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'vcruntime140.dll' -> '\Device\HarddiskVolume2\Windows\System32\vcruntime140.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp140.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp140.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp140.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netapi32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'netapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netapi32.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' -> '\Device\HarddiskVolume2\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mpr.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'uxtheme.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'uxtheme.dll' -> '\Device\HarddiskVolume2\Windows\System32\uxtheme.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.1818: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\LinkShellExtension\HardlinkShellExt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedDllNotificationCallback: load   00007ffe8ed30000 LB 0x0007f000 C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [fFlags=0x0]
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ed30000 'C:\Program Files\LinkShellExtension\HardlinkShellExt.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\LinkShellExtension\HardlinkShellExt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ed30000 'C:\Program Files\LinkShellExtension\HardlinkShellExt.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\LinkShellExtension\HardlinkShellExt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ed30000 'C:\Program Files\LinkShellExtension\HardlinkShellExt.dll'
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Program Files\LinkShellExtension\HardlinkShellExt.dll
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: pName=C:\Program Files\LinkShellExtension\HardlinkShellExt.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8ed30000 'C:\Program Files\LinkShellExtension\HardlinkShellExt.dll'
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001888 pwszName=\Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebd7017fe0
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd7017fe0
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-Optional-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat'; file='\Device\HarddiskVolume2\Windows\System32\wsl.exe'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\wsl.exe'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B635E67EC0105A1ECDAA8E6B1F6F601ADCAF2587
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERROR_NOT_FOUND (1168)
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: New context 000002ebd7017f20
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebd7017f20
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=32 wszDigest=035173EA76332F343A631FFFCB8ED46F73DAE837CD913DFD276272F7800E1F23
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed ERROR_NOT_FOUND (1168)
6c5c.1818: supR3HardNtViCallWinVerifyTrustCatFile -> -22900 (org 22900)
6c5c.1818: supHardenedWinVerifyImageByHandle: -> -22900 (\Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll) WinVerifyTrust
6c5c.1818: Error (rc=0):
6c5c.1818: supR3HardenedScreenImage/LdrLoadDll: rc=-22900 fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll: Not signed.
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1818: Error (rc=0):
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OpenShell\ClassicExplorer64.dll' (D:\Programs\OpenShell\ClassicExplorer64.dll): rcNt=0xc0000190
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OpenShell\ClassicExplorer64.dll'
6c5c.1af0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-22900) on \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/LdrLoadDll: cached rc=-22900 fImage=1 fProtect=0x0 fAccess=0x0 cHits=1 \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OpenShell\ClassicExplorer64.dll' (D:\Programs\OpenShell\ClassicExplorer64.dll): rcNt=0xc0000190
6c5c.1af0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OpenShell\ClassicExplorer64.dll'
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cache hit (-22900) on \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/LdrLoadDll: cached rc=-22900 fImage=1 fProtect=0x0 fAccess=0x0 cHits=2 \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OpenShell\ClassicExplorer64.dll' (D:\Programs\OpenShell\ClassicExplorer64.dll): rcNt=0xc0000190
6c5c.1878: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OpenShell\ClassicExplorer64.dll'
6c5c.b45c: supR3HardenedScreenImage/LdrLoadDll: cache hit (-22900) on \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/LdrLoadDll: cached rc=-22900 fImage=1 fProtect=0x0 fAccess=0x0 cHits=3 \Device\HarddiskVolume7\Programs\OpenShell\ClassicExplorer64.dll
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OpenShell\ClassicExplorer64.dll' (D:\Programs\OpenShell\ClassicExplorer64.dll): rcNt=0xc0000190
6c5c.b45c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OpenShell\ClassicExplorer64.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msctf.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msctf.dll (Input=msctf.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0810000 'C:\Windows\System32\msctf.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001bec pwszName=\Device\HarddiskVolume2\Windows\System32\actxprxy.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=F315F3E030DBA655AE06D8C95D5F11A39CD776C2
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\actxprxy.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\actxprxy.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ActXPrxy.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffeb6040000 LB 0x000a2000 C:\Windows\System32\ActXPrxy.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\actxprxy.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb6040000 'C:\Windows\System32\ActXPrxy.dll'
6c5c.1818: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Program Files\LinkShellExtension\SymbolicLink_Win10.ico)
6c5c.1818: Error (rc=0):
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Program Files\LinkShellExtension\SymbolicLink_Win10.ico: 
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Program Files\LinkShellExtension\SymbolicLink_Win10.ico
6c5c.812c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\floppy.ico)
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\floppy.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\floppy.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\winchester.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\winchester.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\winchester.ico
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\BlackIcons_HostManager.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\BlackIcons_HostManager.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\BlackIcons_HostManager.ico
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\floppy.ico [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\floppy.ico
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\winchester.ico [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\winchester.ico
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\BlackIcons_HostManager.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\BlackIcons_HostManager.ico
6c5c.1818: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Chromatic Disc.ico)
6c5c.1818: Error (rc=0):
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Chromatic Disc.ico: 
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Chromatic Disc.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Chromatic Disc.ico: 
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Chromatic Disc.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\CubXSystems_intuitiv3d_multiple.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\CubXSystems_intuitiv3d_multiple.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\CubXSystems_intuitiv3d_multiple.ico
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\CubXSystems_intuitiv3d_multiple.ico [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\Apps\CubXSystems_intuitiv3d_multiple.ico
6c5c.812c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\NeXT\nfsmount.ico)
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\NeXT\nfsmount.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\NeXT\nfsmount.ico
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\NeXT\nfsmount.ico [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\NeXT\nfsmount.ico
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'bcrypt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'fltlib.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\cldapi.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\cldapi.dll
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\fltLib.dll)
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\fltLib.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffea1870000 LB 0x0000b000 C:\Windows\System32\FLTLIB.DLL [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\fltLib.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffead010000 LB 0x00022000 C:\Windows\System32\cldapi.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\cldapi.dll [avoiding WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'fltlib.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'fltlib.dll' -> '\Device\HarddiskVolume2\Windows\System32\fltlib.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\fltLib.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' -> '\Device\HarddiskVolume2\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\bcrypt.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\fltLib.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000172c pwszName=\Device\HarddiskVolume2\Windows\System32\cldapi.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=07E9002F6FC7D8AE12C68B436BB72F23F733103A
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0515~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\cldapi.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\cldapi.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001904 pwszName=\Device\HarddiskVolume2\Windows\System32\zipfldr.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9483A13378866B978CEF506B68FBE5341C6FEFCF
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0515~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\zipfldr.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'propsys.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'shell32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'shlwapi.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #25 'oleaut32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #27 'rpcrt4.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #33 'gdi32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #36 'ole32.dll'.
6c5c.4de0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #37 'user32.dll'.
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\zipfldr.dll) WinVerifyTrust
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\zipfldr.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\gdi32.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'propsys.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' -> '\Device\HarddiskVolume2\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\propsys.dll
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.4de0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\zipfldr.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\zipfldr.dll
6c5c.4de0: supR3HardenedDllNotificationCallback: load   00007ffe8d6f0000 LB 0x00051000 C:\Windows\system32\zipfldr.dll [fFlags=0x0]
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\zipfldr.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe8d6f0000 'C:\Windows\system32\zipfldr.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\explorerframe.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe92d00000 'C:\Windows\system32\explorerframe.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001860 pwszName=\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=B28424F6250DEA785A982362165D8719CA7EFC77
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'shcore.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'shell32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'shlwapi.dll'.
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\SearchFolder.dll) WinVerifyTrust
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' -> '\Device\HarddiskVolume2\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SearchFolder.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.b5cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'combase.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'rpcrt4.dll'.
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\msxml6.dll) WinVerifyTrust
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\msxml6.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'combase.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' -> '\Device\HarddiskVolume2\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\msxml6.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.b5cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msxml6.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffe98830000 LB 0x0025f000 C:\Windows\System32\msxml6.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\msxml6.dll
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe98830000 'C:\Windows\System32\msxml6.dll'
6c5c.85a8: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\oleaut32.dll
6c5c.85a8: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\OLEAUT32.dll (Input=OLEAUT32, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.85a8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1430000 'C:\Windows\System32\OLEAUT32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001bc0 pwszName=\Device\HarddiskVolume2\Windows\System32\ieframe.dll
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=E561B24299C2C4C7C414620D624607CD1149DC43
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0311~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\ieframe.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'shlwapi.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'msvcrt.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #10 'advapi32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11 'gdi32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'user32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #13 'ole32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #14 'oleaut32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #15 'shell32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #16 'iertutil.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #17 'rpcrt4.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #18 'netapi32.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #19 'version.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #22 'userenv.dll'.
6c5c.b5cc: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #23 'winhttp.dll'.
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\ieframe.dll) WinVerifyTrust
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\ieframe.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winhttp.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'winhttp.dll' -> '\Device\HarddiskVolume2\Windows\System32\winhttp.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\winhttp.dll) WinVerifyTrust
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\winhttp.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'userenv.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' -> '\Device\HarddiskVolume2\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\userenv.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'version.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'version.dll' -> '\Device\HarddiskVolume2\Windows\System32\version.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\version.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'netapi32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'netapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\netapi32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\netapi32.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'iertutil.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'iertutil.dll' -> '\Device\HarddiskVolume2\Windows\System32\iertutil.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\iertutil.dll
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shell32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' -> '\Device\HarddiskVolume2\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' -> '\Device\HarddiskVolume2\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' -> '\Device\HarddiskVolume2\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'advapi32.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' -> '\Device\HarddiskVolume2\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shlwapi.dll'...
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\ieframe.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.b5cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ieframe.dll
6c5c.b5cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winhttp.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffeb9b60000 LB 0x0010a000 C:\Windows\System32\WINHTTP.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\winhttp.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffe77680000 LB 0x0076c000 C:\Windows\System32\ieframe.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ieframe.dll
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll (Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb3380000 'C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe77680000 'C:\Windows\System32\ieframe.dll'
6c5c.b5cc: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-downlevel-ole32-l1-1-0.dll) -> 0x0, fPresent=1
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-downlevel-ole32-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1500000 'api-ms-win-downlevel-ole32-l1-1-0.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-downlevel-shlwapi-l2-1-0.dll) -> 0x0, fPresent=1
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-downlevel-shlwapi-l2-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec1380000 'api-ms-win-downlevel-shlwapi-l2-1-0.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001c98 pwszName=\Device\HarddiskVolume2\Windows\System32\mssprxy.dll
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=2E5BE66EE78407A7FA6E33701AD21E6E89DC15D1
6c5c.6a0c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.6a0c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package051020~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\mssprxy.dll'
6c5c.6a0c: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.6a0c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
6c5c.6a0c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
6c5c.6a0c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'oleaut32.dll'.
6c5c.6a0c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\mssprxy.dll) WinVerifyTrust
6c5c.6a0c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
6c5c.6a0c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
6c5c.6a0c: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\mssprxy.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.6a0c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
6c5c.6a0c: supR3HardenedDllNotificationCallback: load   00007ffeb8dd0000 LB 0x00028000 C:\Windows\system32\mssprxy.dll [fFlags=0x0]
6c5c.6a0c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\mssprxy.dll
6c5c.6a0c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffeb8dd0000 'C:\Windows\system32\mssprxy.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\secur32.dll)
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\secur32.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffea5240000 LB 0x0000c000 C:\Windows\SYSTEM32\Secur32.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\secur32.dll [avoiding WinVerifyTrust]
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\samcli.dll)
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\samcli.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffeb3b20000 LB 0x00019000 C:\Windows\SYSTEM32\samcli.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\samcli.dll [avoiding WinVerifyTrust]
6c5c.b5cc: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\samlib.dll)
6c5c.b5cc: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\samlib.dll
6c5c.b5cc: supR3HardenedDllNotificationCallback: load   00007ffeb9540000 LB 0x00027000 C:\Windows\SYSTEM32\SAMLIB.dll [fFlags=0x0]
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (22900) on \Device\HarddiskVolume2\Windows\System32\samlib.dll [avoiding WinVerifyTrust]
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001cd8 pwszName=\Device\HarddiskVolume2\Windows\System32\samlib.dll
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=617BCD35F6541F95951D1E0F60B315B01FD325D5
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\samlib.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\samlib.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001990 pwszName=\Device\HarddiskVolume2\Windows\System32\samcli.dll
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=6B089072ED4B47CAE52BDDBAB9E39AFEA4BBC2C9
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.6466.cat'; file='\Device\HarddiskVolume2\Windows\System32\samcli.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\samcli.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001e70 pwszName=\Device\HarddiskVolume2\Windows\System32\secur32.dll
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=259805723915A36E7617AD48816E6DC0F2C67652
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.19041.6456.cat'; file='\Device\HarddiskVolume2\Windows\System32\secur32.dll'
6c5c.b5cc: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.b5cc: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\secur32.dll'
6c5c.b5cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.b5cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.b5cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SearchFolder.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.66cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\SearchFolder.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000002009:<flags> [calling]
6c5c.66cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: Error (rc=0):
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cached rc=-5667 fImage=1 fProtect=0x0 fAccess=0x0 cHits=128 \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll
6c5c.66cc: Error (rc=0):
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: rejecting 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll' (D:\Programs\OldNewExplorer\OldNewExplorer64.dll): rcNt=0xc0000190
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'D:\Programs\OldNewExplorer\OldNewExplorer64.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\SearchFolder.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\shell32.dll
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\shell32.dll (Input=shell32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000004001:<flags> [calling]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: load   00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [fFlags=0x0]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe262b0000 'C:\Windows\system32\SearchFolder.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedDllNotificationCallback: Unload 00007ffe262b0000 LB 0x0006a000 C:\Windows\system32\SearchFolder.dll [flags=0x0]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\SHELL32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.66cc: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Company NeXT.ico)
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company NeXT.ico: 
6c5c.4de0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company NeXT.ico
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company NeXT.ico [lacks WinVerifyTrust]
6c5c.4de0: Error (rc=0):
6c5c.4de0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company NeXT.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001dfc (hFile=0000000000001918) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.812c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Dark Cuboid.ico)
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Dark Cuboid.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Dark Cuboid.ico
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Dots.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: '\Device\HarddiskVolume2\Windows\System32\imagesp1.dll' has no imports
6c5c.1878: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\imagesp1.dll)
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\imagesp1.dll
6c5c.1878: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 00000000000018d4 (hFile=0000000000001c30) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Blue.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Blue.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Blue.ico
6c5c.1af0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000001e80 (hFile=0000000000001eb0) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Blue.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Blue.ico
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Dark Cuboid.ico [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Dark Cuboid.ico
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000001da4 pwszName=\Device\HarddiskVolume2\Windows\System32\imagesp1.dll
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000002ebdc1633a0
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20 wszDigest=9FD18666A9A4D666ED68808CAABCDE0791E2C396
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0; cat='C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.6216.cat'; file='\Device\HarddiskVolume2\Windows\System32\imagesp1.dll'
6c5c.4de0: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
6c5c.4de0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900) fWinVerifyTrust=1 for '\Device\HarddiskVolume2\Windows\System32\imagesp1.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Drive.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Drive.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Drive.ico
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Drive.ico [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Drive.ico
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sound.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sound.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sound.ico
6c5c.1818: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directories.ico)
6c5c.1818: Error (rc=0):
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directories.ico: 
6c5c.1818: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directories.ico
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sound.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directories.ico [lacks WinVerifyTrust]
6c5c.1818: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Sound.ico
6c5c.1818: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directories.ico
6c5c.812c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Wireframe Globe.ico)
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Wireframe Globe.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Wireframe Globe.ico
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Wireframe Globe.ico [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Wireframe Globe.ico
6c5c.b45c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Company Amiga.ico)
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company Amiga.ico: 
6c5c.b45c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company Amiga.ico
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company Amiga.ico [lacks WinVerifyTrust]
6c5c.b45c: Error (rc=0):
6c5c.b45c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Company Amiga.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -615 (\Device\HarddiskVolume2\Base\uniextract\UniExtract.exe)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-615 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Base\uniextract\UniExtract.exe: Image is for 'X86_32' and contains code (0x8de00), only accepting images for 'AMD64' with code.
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Base\uniextract\UniExtract.exe
6c5c.812c: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Nice Disc.ico)
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Nice Disc.ico: 
6c5c.812c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Nice Disc.ico
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Nice Disc.ico [lacks WinVerifyTrust]
6c5c.812c: Error (rc=0):
6c5c.812c: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Nice Disc.ico
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1af0: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Tomorrow\Program-Dispatch.ico)
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Program-Dispatch.ico: 
6c5c.1af0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Program-Dispatch.ico
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Program-Dispatch.ico [lacks WinVerifyTrust]
6c5c.1af0: Error (rc=0):
6c5c.1af0: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Tomorrow\Program-Dispatch.ico
6c5c.1878: supHardenedWinVerifyImageByHandle: -> -600 (\Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Green.ico)
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: rc=-600 fImage=1 fProtect=0x5 fAccess=0x2 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Green.ico: 
6c5c.1878: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Green.ico
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cache hit (-600) on \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Green.ico [lacks WinVerifyTrust]
6c5c.1878: Error (rc=0):
6c5c.1878: supR3HardenedScreenImage/NtCreateSection: cached rc=-600 fImage=1 fProtect=0x2 fAccess=0x5 cHits=1 \Device\HarddiskVolume2\Windows\Icons\Sidereal\Directory Green.ico
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.1818: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\ExplorerFrame.dll
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\explorerframe.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags> [calling]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffe92d00000 'C:\Windows\system32\explorerframe.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffe89600000 LB 0x0034c000 C:\Windows\System32\MsftEdit.dll [flags=0x0]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedScreenImage/LdrLoadDll: cache hit (-5667) on \Device\HarddiskVolume7\Programs\OldNewExplorer\OldNewExplorer64.dll [lacks WinVerifyTrust]
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.4de0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0bc0000 'C:\Windows\System32\shell32.dll'
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffea41b0000 LB 0x00146000 C:\Windows\System32\Windows.StateRepositoryPS.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffeb8dd0000 LB 0x00028000 C:\Windows\system32\mssprxy.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffebcfd0000 LB 0x000a3000 C:\Windows\System32\PortableDeviceApi.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffe84930000 LB 0x000a1000 C:\Windows\system32\wpdshext.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffeba3d0000 LB 0x001a8000 C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.6456_none_91a399b0cc88bc24\gdiplus.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffe77680000 LB 0x0076c000 C:\Windows\System32\ieframe.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffeb9b60000 LB 0x0010a000 C:\Windows\System32\WINHTTP.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffeb2fb0000 LB 0x00026000 C:\Windows\System32\EhStorAPI.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffe98830000 LB 0x0025f000 C:\Windows\System32\msxml6.dll [flags=0x0]
6c5c.78b0: supR3HardenedDllNotificationCallback: Unload 00007ffea5e00000 LB 0x00064000 C:\Windows\System32\PlayToDevice.dll [flags=0x0]
6c5c.4de0: supR3HardenedMonitor_NtCreateSection: NtMapViewOfSection failed on 0000000000000d00 (hFile=0000000000001d28) with 0xc0000022 -> STATUS_TRUST_FAILURE
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebed80000 'C:\Windows\system32\rsaenh.dll'
6c5c.4684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\wintrust.dll
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\WINTRUST.DLL (Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0410000 'C:\Windows\System32\WINTRUST.DLL'
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\CRYPT32.dll'
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffec0490000 'C:\Windows\System32\crypt32.dll'
6c5c.4684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcp_win.dll'.
6c5c.4684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'rpcrt4.dll'.
6c5c.4684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #7 'oleaut32.dll'.
6c5c.4684: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #29 'mmdevapi.dll'.
6c5c.4684: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Windows\System32\AudioSes.dll) WinVerifyTrust
6c5c.4684: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mmdevapi.dll'...
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' -> '\Device\HarddiskVolume2\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
6c5c.4684: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\MMDevAPI.dll
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'oleaut32.dll'...
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' -> '\Device\HarddiskVolume2\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume2\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcp_win.dll'...
6c5c.4684: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' -> '\Device\HarddiskVolume2\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\AUDIOSES.DLL (Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
6c5c.4684: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
6c5c.4684: supR3HardenedDllNotificationCallback: load   00007ffebc760000 LB 0x00181000 C:\Windows\System32\AUDIOSES.DLL [fFlags=0x0]
6c5c.4684: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\AudioSes.dll
6c5c.4684: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffebc760000 'C:\Windows\System32\AUDIOSES.DLL'
6c5c.3698: supR3HardenedDllNotificationCallback: Unload 00007ffeae320000 LB 0x0000d000 D:\Programs\VirtualBox\VBoxGuestPropSvc.DLL [flags=0x0]
6c5c.a6d0: supR3HardenedDllNotificationCallback: Unload 00007ffeae330000 LB 0x0000c000 D:\Programs\VirtualBox\VBoxGuestControlSvc.DLL [flags=0x0]
6c5c.5314: supR3HardenedDllNotificationCallback: Unload 00007ffeae510000 LB 0x00014000 D:\Programs\VirtualBox\VBoxSharedFolders.DLL [flags=0x0]
6c5c.318c: supR3HardenedDllNotificationCallback: Unload 00007ffeb2f90000 LB 0x0000d000 D:\Programs\VirtualBox\VBoxDragAndDropSvc.DLL [flags=0x0]
6c5c.59b8: supR3HardenedDllNotificationCallback: Unload 00007ffeb2fa0000 LB 0x00010000 D:\Programs\VirtualBox\VBoxSharedClipboard.DLL [flags=0x0]
6c5c.bbb0: supR3HardenedDllNotificationCallback: Unload 00007ffe80ee0000 LB 0x00b9a000 D:\Programs\VirtualBox\VBoxDD.DLL [flags=0x0]
6c5c.bbb0: supR3HardenedDllNotificationCallback: Unload 00007ffea5c90000 LB 0x00071000 D:\Programs\VirtualBox\VBoxDDU.dll [flags=0x0]
6c5c.bbb0: supR3HardenedDllNotificationCallback: Unload 00007ffe80680000 LB 0x0085d000 D:\Programs\VirtualBox\VBoxDD2.dll [flags=0x0]
6c5c.bbb0: supR3HardenedDllNotificationCallback: Unload 00007ffebf140000 LB 0x0003b000 C:\Windows\SYSTEM32\IPHLPAPI.DLL [flags=0x0]
6c5c.4de0: supR3HardenedDllNotificationCallback: Unload 00007ffe81a80000 LB 0x004d8000 D:\Programs\VirtualBox\VBoxVMM.DLL [flags=0x0]
6c5c.4de0: Terminating the normal way: rcExit=0
6cd0.7988: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 7679748 ms, the end);
b588.74c8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 7680723 ms, the end);
