V Box Hardening

47c8.47cc: Log file opened: 6.1.
2r135662 g_hStartupLog=0000000000000074
g_uNtVerCombined=0xa047bb00
47c8.47cc: \SystemRoot\System32\ntdll.dll:
47c8.47cc: CreationTime: 2020-11-12T07:09:03.581221700Z
47c8.47cc: LastWriteTime: 2020-11-12T07:09:03.643704600Z
47c8.47cc: ChangeTime: 2020-12-09T19:37:28.797922900Z
47c8.47cc: FileAttributes: 0x20
47c8.47cc: Size: 0x1e8058
47c8.47cc: NT Headers: 0xd8
47c8.47cc: Timestamp: 0x103a4719
47c8.47cc: Machine: 0x8664 - amd64
47c8.47cc: Timestamp: 0x103a4719
47c8.47cc: Image Version: 10.0
47c8.47cc: SizeOfImage: 0x1f0000 (2031616)
47c8.47cc: Resource Dir: 0x17f000 LB 0x6f3b8
47c8.47cc: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName:
0x409)]
47c8.47cc: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0
(reserved 0x0)]
47c8.47cc: ProductName: Microsoft® Windows® Operating System
47c8.47cc: ProductVersion: 10.0.18362.1171
47c8.47cc: FileVersion: 10.0.18362.1171 (WinBuild.160101.0800)
47c8.47cc: FileDescription: NT Layer DLL
47c8.47cc: \SystemRoot\System32\kernel32.dll:
47c8.47cc: Size: 0xb04a0
47c8.47cc: NT Headers: 0xf8
47c8.47cc: Timestamp: 0x2d28261f
47c8.47cc: Timestamp: 0x2d28261f
47c8.47cc: SizeOfImage: 0xb2000 (729088)
47c8.47cc: Resource Dir: 0xb0000 LB 0x520
47c8.47cc: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName:
0x409)]
47c8.47cc: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved
0x0)]
47c8.47cc: FileDescription: Windows NT BASE API Client DLL
47c8.47cc: \SystemRoot\System32\KernelBase.dll:
47c8.47cc: Size: 0x2a5c88
47c8.47cc: NT Headers: 0x100
47c8.47cc: Timestamp: 0x71e81044
47c8.47cc: Timestamp: 0x71e81044
47c8.47cc: SizeOfImage: 0x2a5000 (2772992)
47c8.47cc: Resource Dir: 0x27f000 LB 0x548
0x409)]
47c8.47cc: [Raw version resource data: 0x27f0b0 LB 0x3bc, codepage 0x0
(reserved 0x0)]
47c8.47cc: FileDescription: Windows NT BASE API Client DLL
47c8.47cc: \SystemRoot\System32\apisetschema.dll:
47c8.47cc: Size: 0x1d028
47c8.47cc: NT Headers: 0xc8
47c8.47cc: Timestamp: 0xd6ced080
47c8.47cc: Timestamp: 0xd6ced080
47c8.47cc: SizeOfImage: 0x1e000 (122880)
47c8.47cc: Resource Dir: 0x1d000 LB 0x408
0x409)]
47c8.47cc: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved
0x0)]
47c8.47cc: FileDescription: ApiSet Schema DLL
47c8.47cc: NtOpenDirectoryObject failed on \Driver: 0xc0000022
47c8.47cc: supR3HardenedWinFindAdversaries: 0x0
47c8.47cc: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox'
47c8.47cc: Calling main()
47c8.47cc: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
47c8.47cc: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume3\Program
47c8.47cc: SUPR3HardenedMain: Respawn #1
47c8.47cc: System32: \Device\HarddiskVolume6\Windows\System32
47c8.47cc: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS
47c8.47cc: KnownDllPath: C:\WINDOWS\System32
47c8.47cc: supR3HardenedWinInit: Performing a limited self purification...
47c8.47cc: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION
47c8.47cc: *0000000000000000-00000000006effff 0x0001/0x0000 0x0000000
47c8.47cc: *00000000006f0000-00000000006fffff 0x0004/0x0004 0x0040000
47c8.47cc: 0000000000700000-000000000070ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000710000-000000000072afff 0x0002/0x0002 0x0040000
47c8.47cc: 000000000072b000-000000000072ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000730000-0000000000733fff 0x0002/0x0002 0x0040000
47c8.47cc: 0000000000734000-000000000073ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000740000-0000000000741fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000742000-000000000074ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000750000-0000000000751fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000752000-00000000007b1fff 0x0000/0x0004 0x0020000
47c8.47cc: 00000000007b2000-00000000007dffff 0x0001/0x0000 0x0000000
47c8.47cc: *00000000007e0000-00000000007eefff 0x0004/0x0004 0x0020000
47c8.47cc: 00000000007ef000-00000000007effff 0x0000/0x0004 0x0020000
47c8.47cc: 00000000007f0000-00000000007fffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000800000-0000000000940fff 0x0000/0x0004 0x0020000
47c8.47cc: 0000000000941000-0000000000943fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000944000-00000000009fffff 0x0000/0x0004 0x0020000
47c8.47cc: *0000000000a00000-0000000000ab8fff 0x0000/0x0004 0x0020000
47c8.47cc: 0000000000ab9000-0000000000abbfff 0x0104/0x0004 0x0020000
47c8.47cc: 0000000000abc000-0000000000afffff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000b00000-0000000000baffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000bb0000-0000000000bb5fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000bb6000-0000000000caffff 0x0000/0x0004 0x0020000
47c8.47cc: *0000000000cb0000-0000000000d76fff 0x0002/0x0002 0x0040000
47c8.47cc: 0000000000d77000-0000000000d7ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000d80000-0000000000d81fff 0x0000/0x0004 0x0020000
47c8.47cc: 0000000000d82000-0000000000f72fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000f73000-0000000000f73fff 0x0000/0x0004 0x0020000
47c8.47cc: 0000000000f74000-0000000000f7ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000f80000-0000000000f9cfff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000000f9d000-000000000107ffff 0x0000/0x0004 0x0020000
47c8.47cc: 0000000001080000-000000007ffdffff 0x0001/0x0000 0x0000000
47c8.47cc: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
47c8.47cc: 000000007ffe1000-000000007ffebfff 0x0001/0x0000 0x0000000
47c8.47cc: *000000007ffec000-000000007ffecfff 0x0002/0x0002 0x0020000
47c8.47cc: 000000007ffed000-00007ff49e86ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff49e870000-00007ff49e874fff 0x0002/0x0002 0x0040000
47c8.47cc: 00007ff49e875000-00007ff49e96ffff 0x0000/0x0002 0x0040000
47c8.47cc: *00007ff49e970000-00007ff59e98ffff 0x0000/0x0004 0x0020000
47c8.47cc: *00007ff59e990000-00007ff5a098ffff 0x0000/0x0004 0x0020000
47c8.47cc: 00007ff5a0990000-00007ff5a0990fff 0x0004/0x0004 0x0020000
47c8.47cc: 00007ff5a0991000-00007ff5a099ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff5a09a0000-00007ff5a09a0fff 0x0002/0x0002 0x0040000
47c8.47cc: 00007ff5a09a1000-00007ff5a09affff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff5a09b0000-00007ff5a09d2fff 0x0002/0x0002 0x0040000
47c8.47cc: 00007ff5a09d3000-00007ff74af3ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff74af40000-00007ff74af40fff 0x0002/0x0080 0x1000000
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
47c8.47cc: 00007ff74af41000-00007ff74afb6fff 0x0020/0x0080 0x1000000
47c8.47cc: 00007ff74afb7000-00007ff74afb7fff 0x0080/0x0080 0x1000000
47c8.47cc: 00007ff74afb8000-00007ff74affffff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff74b000000-00007ff74b002fff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff74b00a000-00007ff74b00bfff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff74b00c000-00007ff74b00cfff 0x0008/0x0080 0x1000000
47c8.47cc: 00007ff74b00d000-00007ff74b055fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff74b056000-00007ff8b35bffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff8b35c0000-00007ff8b35c0fff 0x0002/0x0080 0x1000000
\Device\HarddiskVolume6\Windows\System32\KernelBase.dll
47c8.47cc: 00007ff8b35c1000-00007ff8b36c6fff 0x0020/0x0080 0x1000000
47c8.47cc: 00007ff8b36c7000-00007ff8b3829fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b382a000-00007ff8b382dfff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff8b382e000-00007ff8b382efff 0x0008/0x0080 0x1000000
47c8.47cc: 00007ff8b382f000-00007ff8b3864fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b3865000-00007ff8b4b7ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff8b4b80000-00007ff8b4b80fff 0x0002/0x0080 0x1000000
\Device\HarddiskVolume6\Windows\System32\kernel32.dll
47c8.47cc: 00007ff8b4b81000-00007ff8b4bf5fff 0x0020/0x0080 0x1000000
47c8.47cc: 00007ff8b4bf6000-00007ff8b4c27fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b4c2a000-00007ff8b4c31fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b4c32000-00007ff8b615ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff8b6160000-00007ff8b6160fff 0x0002/0x0080 0x1000000
\Device\HarddiskVolume6\Windows\System32\ntdll.dll
47c8.47cc: 00007ff8b6278000-00007ff8b62befff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b62bf000-00007ff8b62bffff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff8b62c2000-00007ff8b62cafff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff8b62cb000-00007ff8b634ffff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b6350000-00007ffffffeffff 0x0001/0x0000 0x0000000
47c8.47cc: kernel32.dll: timestamp 0x2d28261f (rc=VINF_SUCCESS)
47c8.47cc: kernelbase.dll: timestamp 0x71e81044 (rc=VINF_SUCCESS)
47c8.47cc: VirtualBoxVM.exe: timestamp 0x5e1f1d0f (rc=VINF_SUCCESS)
47c8.47cc: '\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VirtualBoxVM.exe' has no imports
47c8.47cc: '\Device\HarddiskVolume6\Windows\System32\ntdll.dll' has no imports
47c8.47cc: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED ->
VINF_SUCCESS, cFixes=0
47c8.47cc: '\Device\HarddiskVolume3\Program
47c8.47cc: supHardenedWinVerifyImageByHandle: -> 24202
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe)
47c8.47cc: supR3HardNtEnableThreadCreationEx:
47c8.47cc: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8b61d1df0
pvNtTerminateThread=00007ff8b61fd140
47c8.47cc: supR3HardenedWinDoReSpawn(1): New child 47e0.47e4 [kernel32].
47c8.47cc: supR3HardNtChildGatherData: PebBaseAddress=00000000010c4000 cbPeb=0x388
47c8.47cc: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff8b6160000
uNtDllChildAddr=00007ff8b6160000
47c8.47cc: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff8b61d1df0
47c8.47cc: supR3HardenedWinSetupChildInit: Initial context:
rax=0000000000000000 rbx=0000000000000000 rcx=00007ff74af47900
rdx=00000000010c4000
rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9
=0000000000000000
r10=0000000000000000 r11=0000000000000000 r12=0000000000000000
r13=0000000000000000
r14=0000000000000000 r15=0000000000000000 P1=0000000000000000
P2=0000000000000000
rip=00007ff8b61cd4b0 rsp=000000000131fb78 rbp=0000000000000000
ctxflags=0010001b
cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200
mxcrx=00001f80
P3=0000000000000000 P4=0000000000000000 P5=0000000000000000
P6=0000000000000000
dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000
dr3=0000000000000000
dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000
dcr=0000000000000000
lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000
lxf=0000000000000000
47c8.47cc: supR3HardenedWinSetupChildInit: Start child.
47c8.47cc: supR3HardNtChildWaitFor: Found expected request 0
(PurifyChildAndCloseHandles) after 0 ms.
47c8.47cc: supR3HardNtChildPurify: Startup delay kludge #1/0: 262 ms, 19 sleeps
47c8.47cc: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
47c8.47cc: *0000000000000000-0000000000fcffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000000fd0000-0000000000feffff 0x0004/0x0004 0x0020000
47c8.47cc: *0000000000ff0000-0000000000ff3fff 0x0002/0x0002 0x0040000
47c8.47cc: 0000000000ff4000-0000000000ffffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000001000000-00000000010c3fff 0x0000/0x0004 0x0020000
47c8.47cc: 00000000010c4000-00000000010c6fff 0x0004/0x0004 0x0020000
47c8.47cc: 00000000010c7000-00000000011fffff 0x0000/0x0004 0x0020000
47c8.47cc: *0000000001200000-000000000121afff 0x0002/0x0002 0x0040000
47c8.47cc: 000000000121b000-000000000121ffff 0x0001/0x0000 0x0000000
47c8.47cc: *0000000001220000-000000000131afff 0x0000/0x0004 0x0020000
47c8.47cc: 000000000131b000-000000000131dfff 0x0104/0x0004 0x0020000
47c8.47cc: 000000000131e000-000000000131ffff 0x0004/0x0004 0x0020000
47c8.47cc: *0000000001320000-0000000001321fff 0x0004/0x0004 0x0020000
47c8.47cc: 0000000001322000-000000007ffdffff 0x0001/0x0000 0x0000000
47c8.47cc: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
47c8.47cc: 000000007ffe1000-000000007ffebfff 0x0001/0x0000 0x0000000
47c8.47cc: *000000007ffec000-000000007ffecfff 0x0002/0x0002 0x0020000
47c8.47cc: 000000007ffed000-00007ff5022dffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff5022e0000-00007ff5022e0fff 0x0002/0x0002 0x0040000
47c8.47cc: 00007ff5022e1000-00007ff5022effff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff5022f0000-00007ff502312fff 0x0002/0x0002 0x0040000
47c8.47cc: 00007ff502313000-00007ff74af3ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff74af40000-00007ff74af40fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff74af41000-00007ff74afb6fff 0x0020/0x0080 0x1000000
47c8.47cc: 00007ff74afb7000-00007ff74afb7fff 0x0080/0x0080 0x1000000
47c8.47cc: 00007ff74afb8000-00007ff74affffff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff74b009000-00007ff74b00cfff 0x0008/0x0080 0x1000000
47c8.47cc: 00007ff74b00d000-00007ff74b055fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff74b056000-00007ff8b615ffff 0x0001/0x0000 0x0000000
47c8.47cc: *00007ff8b6160000-00007ff8b6160fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b6278000-00007ff8b62befff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b62bf000-00007ff8b62cafff 0x0008/0x0080 0x1000000
47c8.47cc: 00007ff8b62cb000-00007ff8b62d9fff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b62da000-00007ff8b62dafff 0x0004/0x0080 0x1000000
47c8.47cc: 00007ff8b62db000-00007ff8b62ddfff 0x0008/0x0080 0x1000000
47c8.47cc: 00007ff8b62de000-00007ff8b634ffff 0x0002/0x0080 0x1000000
47c8.47cc: 00007ff8b6350000-00007ffffffeffff 0x0001/0x0000 0x0000000
47c8.47cc: supR3HardNtChildPurify: Done after 265 ms and 0 fixes (loop #0).
47e0.47e4: Log file opened: 6.1.2r135662 g_hStartupLog=0000000000000004
47e0.47e4: supR3HardenedVmProcessInit: uNtDllAddr=00007ff8b6160000
g_uNtVerCombined=0xa047bb00 (stack ~000000000131f608)
47e0.47e4: ntdll.dll: timestamp 0x103a4719 (rc=VINF_SUCCESS)
47e0.47e4: New simple heap: #1 0000000001430000 LB 0x400000 (for 2031616
allocation)
47c8.47cc: supR3HardNtEnableThreadCreationEx:
47e0.47e4: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program
47e0.47e4: System32: \Device\HarddiskVolume6\Windows\System32
47e0.47e4: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS
47e0.47e4: KnownDllPath: C:\WINDOWS\System32
47e0.47e4: supR3HardenedVmProcessInit: Opening vboxdrv stub...
47e0.47e4: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
47e0.47e4: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
47e0.47e4: Registered Dll notification callback with NTDLL.
47e0.47e4: supHardenedWinVerifyImageByHandle: -> 0
(\Device\HarddiskVolume6\Windows\System32\kernel32.dll)
47e0.47e4: supR3HardenedWinVerifyCacheInsert:
47e0.47e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL
(Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff
pwszSearchPath=0000000000004001:<flags> [calling]
47e0.47e4: supR3HardenedDllNotificationCallback: load 00007ff8b35c0000 LB
0x002a5000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\KernelBase.dll)
47e0.47e4: supR3HardenedDllNotificationCallback: load 00007ff8b4b80000 LB
0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
47e0.47e4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
47e0.47e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4b80000
'C:\WINDOWS\System32\KERNEL32.DLL'
47e0.47e4: supR3HardenedDllNotificationCallback: load 00007ff74af40000 LB
0x00116000 E:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
47e0.47e4: '\Device\HarddiskVolume3\Program
47e0.47e4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VirtualBoxVM.exe
47e0.47e4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8b61d1df0
47c8.47cc: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 64
ms.
47e0.47e4: \SystemRoot\System32\ntdll.dll:
47e0.47e4: CreationTime: 2020-11-12T07:09:03.581221700Z
47e0.47e4: LastWriteTime: 2020-11-12T07:09:03.643704600Z
47e0.47e4: ChangeTime: 2020-12-09T19:37:28.797922900Z
47e0.47e4: FileAttributes: 0x20
47e0.47e4: Size: 0x1e8058
47e0.47e4: NT Headers: 0xd8
47e0.47e4: Timestamp: 0x103a4719
47e0.47e4: Machine: 0x8664 - amd64
47e0.47e4: Timestamp: 0x103a4719
47e0.47e4: Image Version: 10.0
47e0.47e4: SizeOfImage: 0x1f0000 (2031616)
47e0.47e4: Resource Dir: 0x17f000 LB 0x6f3b8
47e0.47e4: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName:
0x409)]
47e0.47e4: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0
(reserved 0x0)]
47e0.47e4: ProductName: Microsoft® Windows® Operating System
47e0.47e4: ProductVersion: 10.0.18362.1171
47e0.47e4: FileVersion: 10.0.18362.1171 (WinBuild.160101.0800)
47e0.47e4: FileDescription: NT Layer DLL
47e0.47e4: \SystemRoot\System32\kernel32.dll:
47e0.47e4: ChangeTime: 2020-12-09T19:37:28.487986700Z
47e0.47e4: Size: 0xb04a0
47e0.47e4: NT Headers: 0xf8
47e0.47e4: Timestamp: 0x2d28261f
47e0.47e4: Machine: 0x8664 - amd64
47e0.47e4: Timestamp: 0x2d28261f
47e0.47e4: SizeOfImage: 0xb2000 (729088)
47e0.47e4: Resource Dir: 0xb0000 LB 0x520
47e0.47e4: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName:
0x409)]
47e0.47e4: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved
0x0)]
47e0.47e4: FileDescription: Windows NT BASE API Client DLL
47e0.47e4: \SystemRoot\System32\KernelBase.dll:
47e0.47e4: ChangeTime: 2020-12-09T19:46:37.878446000Z
47e0.47e4: Size: 0x2a5c88
47e0.47e4: NT Headers: 0x100
47e0.47e4: Timestamp: 0x71e81044
47e0.47e4: Machine: 0x8664 - amd64
47e0.47e4: Timestamp: 0x71e81044
47e0.47e4: SizeOfImage: 0x2a5000 (2772992)
47e0.47e4: Resource Dir: 0x27f000 LB 0x548
0x409)]
47e0.47e4: [Raw version resource data: 0x27f0b0 LB 0x3bc, codepage 0x0
(reserved 0x0)]
47e0.47e4: FileDescription: Windows NT BASE API Client DLL
47e0.47e4: \SystemRoot\System32\apisetschema.dll:
47e0.47e4: ChangeTime: 2020-12-09T19:37:28.455072000Z
47e0.47e4: Size: 0x1d028
47e0.47e4: NT Headers: 0xc8
47e0.47e4: Timestamp: 0xd6ced080
47e0.47e4: Machine: 0x8664 - amd64
47e0.47e4: Timestamp: 0xd6ced080
47e0.47e4: SizeOfImage: 0x1e000 (122880)
47e0.47e4: Resource Dir: 0x1d000 LB 0x408
0x409)]
47e0.47e4: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved
0x0)]
47e0.47e4: FileDescription: ApiSet Schema DLL
47e0.47e4: NtOpenDirectoryObject failed on \Driver: 0xc0000022
47e0.47e4: supR3HardenedWinFindAdversaries: 0x0
47e0.47e4: Calling main()
47e0.47e4: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
47e0.47e4: SUPR3HardenedMain: Respawn #2
47e0.47e4: supR3HardNtEnableThreadCreationEx:
47e0.47e4: supR3HardenedDllNotificationCallback: load 00007ff8b5730000 LB
0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll)
\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll
47e0.47e4: supR3HardenedDllNotificationCallback: load 00007ff8b5a70000 LB
0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
47e0.47e4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #11
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\sechost.dll)
\Device\HarddiskVolume6\Windows\System32\sechost.dll
47e0.47e4: '\Device\HarddiskVolume6\Windows\System32\ntdll.dll' has no imports
(\Device\HarddiskVolume6\Windows\System32\ntdll.dll)
47e0.47e4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'rpcrt4.dll'...
47e0.47e4: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' ->
'\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
47e0.47e4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
47e0.47e4: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll
(Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e0.47e4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b6160000
'C:\WINDOWS\System32\ntdll.dll'
47e0.47e4: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8b61d1df0
47e0.47e4: supR3HardenedWinDoReSpawn(2): New child 47e8.47ec [kernel32].
47e0.47e4: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger
failed: 0xc0000022 (harmless)
47e0.47e4: supR3HardNtChildGatherData: PebBaseAddress=000000000024a000 cbPeb=0x388
47e0.47e4: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff8b6160000
uNtDllChildAddr=00007ff8b6160000
47e0.47e4: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff8b61d1df0
47e0.47e4: supR3HardenedWinSetupChildInit: Initial context:
rax=0000000000000000 rbx=0000000000000000 rcx=00007ff74af47900
rdx=000000000024a000
rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9
=0000000000000000
r10=0000000000000000 r11=0000000000000000 r12=0000000000000000
r13=0000000000000000
r14=0000000000000000 r15=0000000000000000 P1=0000000000000000
P2=0000000000000000
rip=00007ff8b61cd4b0 rsp=00000000004fff58 rbp=0000000000000000
ctxflags=0010001b
cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200
mxcrx=00001f80
P3=0000000000000000 P4=0000000000000000 P5=0000000000000000
P6=0000000000000000
dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000
dr3=0000000000000000
dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000
dcr=0000000000000000
lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000
lxf=0000000000000000
47e0.47e4: kernel32.dll: timestamp 0x2d28261f (rc=VINF_SUCCESS)
47e0.47e4: supR3HardenedWinSetupChildInit: Start child.
47e0.47e4: supR3HardNtChildWaitFor: Found expected request 0
(PurifyChildAndCloseHandles) after 0 ms.
47e0.47e4: supR3HardNtChildPurify: Startup delay kludge #1/0: 259 ms, 31 sleeps
47e0.47e4: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
47e0.47e4: *0000000000000000-000000000017ffff 0x0001/0x0000 0x0000000
47e0.47e4: *0000000000180000-000000000019ffff 0x0004/0x0004 0x0020000
47e0.47e4: *00000000001a0000-00000000001bafff 0x0002/0x0002 0x0040000
47e0.47e4: 00000000001bb000-00000000001bffff 0x0001/0x0000 0x0000000
47e0.47e4: *00000000001c0000-00000000001c3fff 0x0002/0x0002 0x0040000
47e0.47e4: 00000000001c4000-00000000001cffff 0x0001/0x0000 0x0000000
47e0.47e4: *00000000001d0000-00000000001d1fff 0x0004/0x0004 0x0020000
47e0.47e4: 00000000001d2000-00000000001fffff 0x0001/0x0000 0x0000000
47e0.47e4: *0000000000200000-0000000000249fff 0x0000/0x0004 0x0020000
47e0.47e4: 000000000024a000-000000000024cfff 0x0004/0x0004 0x0020000
47e0.47e4: 000000000024d000-00000000003fffff 0x0000/0x0004 0x0020000
47e0.47e4: *0000000000400000-00000000004fafff 0x0000/0x0004 0x0020000
47e0.47e4: 00000000004fb000-00000000004fdfff 0x0104/0x0004 0x0020000
47e0.47e4: 00000000004fe000-00000000004fffff 0x0004/0x0004 0x0020000
47e0.47e4: 0000000000500000-000000007ffdffff 0x0001/0x0000 0x0000000
47e0.47e4: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
47e0.47e4: 000000007ffe1000-000000007ffebfff 0x0001/0x0000 0x0000000
47e0.47e4: *000000007ffec000-000000007ffecfff 0x0002/0x0002 0x0020000
47e0.47e4: 000000007ffed000-00007ff5d8f1ffff 0x0001/0x0000 0x0000000
47e0.47e4: *00007ff5d8f20000-00007ff5d8f20fff 0x0002/0x0002 0x0040000
47e0.47e4: 00007ff5d8f21000-00007ff5d8f2ffff 0x0001/0x0000 0x0000000
47e0.47e4: *00007ff5d8f30000-00007ff5d8f52fff 0x0002/0x0002 0x0040000
47e0.47e4: 00007ff5d8f53000-00007ff74af3ffff 0x0001/0x0000 0x0000000
47e0.47e4: *00007ff74af40000-00007ff74af40fff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff74af41000-00007ff74afb6fff 0x0020/0x0080 0x1000000
47e0.47e4: 00007ff74afb7000-00007ff74afb7fff 0x0080/0x0080 0x1000000
47e0.47e4: 00007ff74afb8000-00007ff74affffff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff74b000000-00007ff74b000fff 0x0004/0x0080 0x1000000
47e0.47e4: 00007ff74b001000-00007ff74b001fff 0x0008/0x0080 0x1000000
47e0.47e4: 00007ff74b002000-00007ff74b006fff 0x0004/0x0080 0x1000000
47e0.47e4: 00007ff74b007000-00007ff74b007fff 0x0008/0x0080 0x1000000
47e0.47e4: 00007ff74b008000-00007ff74b008fff 0x0004/0x0080 0x1000000
47e0.47e4: 00007ff74b009000-00007ff74b00cfff 0x0008/0x0080 0x1000000
47e0.47e4: 00007ff74b00d000-00007ff74b055fff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff74b056000-00007ff8b615ffff 0x0001/0x0000 0x0000000
47e0.47e4: *00007ff8b6160000-00007ff8b6160fff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff8b6161000-00007ff8b6277fff 0x0020/0x0080 0x1000000
47e0.47e4: 00007ff8b6278000-00007ff8b62befff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff8b62bf000-00007ff8b62cafff 0x0008/0x0080 0x1000000
47e0.47e4: 00007ff8b62cb000-00007ff8b62d9fff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff8b62da000-00007ff8b62dafff 0x0004/0x0080 0x1000000
47e0.47e4: 00007ff8b62db000-00007ff8b62ddfff 0x0008/0x0080 0x1000000
47e0.47e4: 00007ff8b62de000-00007ff8b634ffff 0x0002/0x0080 0x1000000
47e0.47e4: 00007ff8b6350000-00007ffffffeffff 0x0001/0x0000 0x0000000
47e0.47e4: VirtualBoxVM.exe: timestamp 0x5e1f1d0f (rc=VINF_SUCCESS)
47e0.47e4: '\Device\HarddiskVolume6\Windows\System32\ntdll.dll' has no imports
47e0.47e4: supR3HardNtChildPurify: Done after 285 ms and 0 fixes (loop #0).
47e8.47ec: Log file opened: 6.1.2r135662 g_hStartupLog=0000000000000004
47e8.47ec: supR3HardenedVmProcessInit: uNtDllAddr=00007ff8b6160000
g_uNtVerCombined=0xa047bb00 (stack ~00000000004ff9e8)
47e8.47ec: ntdll.dll: timestamp 0x103a4719 (rc=VINF_SUCCESS)
47e8.47ec: New simple heap: #1 0000000000600000 LB 0x400000 (for 2031616
allocation)
47e0.47e4: supR3HardenedEarlyCompact: Removed heap 1 (0x00000001430000 LB 0x400000)
47e0.47e4: supR3HardNtEnableThreadCreationEx:
47e8.47ec: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume3\Program
47e8.47ec: System32: \Device\HarddiskVolume6\Windows\System32
47e8.47ec: WinSxS: \Device\HarddiskVolume6\Windows\WinSxS
47e8.47ec: KnownDllPath: C:\WINDOWS\System32
47e8.47ec: supR3HardenedVmProcessInit: Opening vboxdrv...
47e8.47ec: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
47e8.47ec: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
47e8.47ec: Registered Dll notification callback with NTDLL.
47e8.47ec: supHardenedWinVerifyImageByHandle: -> 0
(\Device\HarddiskVolume6\Windows\System32\kernel32.dll)
47e8.47ec: supR3HardenedWinVerifyCacheInsert:
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\KERNEL32.DLL
(Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b35c0000 LB
0x002a5000 C:\WINDOWS\System32\KERNELBASE.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\KernelBase.dll)
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b4b80000 LB
0x000b2000 C:\WINDOWS\System32\KERNEL32.DLL [fFlags=0x0]
47e8.47ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4b80000
'C:\WINDOWS\System32\KERNEL32.DLL'
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff74af40000 LB
0x00116000 E:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe [fFlags=0x0]
47e8.47ec: '\Device\HarddiskVolume3\Program
47e8.47ec: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VirtualBoxVM.exe
47e8.47ec: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff8b61d1df0
47e0.47e4: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 68
ms.
47e8.47ec: \SystemRoot\System32\ntdll.dll:
47e8.47ec: CreationTime: 2020-11-12T07:09:03.581221700Z
47e8.47ec: LastWriteTime: 2020-11-12T07:09:03.643704600Z
47e8.47ec: ChangeTime: 2020-12-09T19:37:28.797922900Z
47e8.47ec: FileAttributes: 0x20
47e8.47ec: Size: 0x1e8058
47e8.47ec: NT Headers: 0xd8
47e8.47ec: Timestamp: 0x103a4719
47e8.47ec: Machine: 0x8664 - amd64
47e8.47ec: Timestamp: 0x103a4719
47e8.47ec: Image Version: 10.0
47e8.47ec: SizeOfImage: 0x1f0000 (2031616)
47e8.47ec: Resource Dir: 0x17f000 LB 0x6f3b8
47e8.47ec: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName:
0x409)]
47e8.47ec: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0
(reserved 0x0)]
47e8.47ec: ProductName: Microsoft® Windows® Operating System
47e8.47ec: ProductVersion: 10.0.18362.1171
47e8.47ec: FileVersion: 10.0.18362.1171 (WinBuild.160101.0800)
47e8.47ec: FileDescription: NT Layer DLL
47e8.47ec: \SystemRoot\System32\kernel32.dll:
47e8.47ec: Size: 0xb04a0
47e8.47ec: NT Headers: 0xf8
47e8.47ec: Timestamp: 0x2d28261f
47e8.47ec: Timestamp: 0x2d28261f
47e8.47ec: SizeOfImage: 0xb2000 (729088)
47e8.47ec: Resource Dir: 0xb0000 LB 0x520
47e8.47ec: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName:
0x409)]
47e8.47ec: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved
0x0)]
47e8.47ec: FileDescription: Windows NT BASE API Client DLL
47e8.47ec: \SystemRoot\System32\KernelBase.dll:
47e8.47ec: Size: 0x2a5c88
47e8.47ec: NT Headers: 0x100
47e8.47ec: Timestamp: 0x71e81044
47e8.47ec: Timestamp: 0x71e81044
47e8.47ec: SizeOfImage: 0x2a5000 (2772992)
47e8.47ec: Resource Dir: 0x27f000 LB 0x548
0x409)]
47e8.47ec: [Raw version resource data: 0x27f0b0 LB 0x3bc, codepage 0x0
(reserved 0x0)]
47e8.47ec: FileDescription: Windows NT BASE API Client DLL
47e8.47ec: \SystemRoot\System32\apisetschema.dll:
47e8.47ec: Size: 0x1d028
47e8.47ec: NT Headers: 0xc8
47e8.47ec: Timestamp: 0xd6ced080
47e8.47ec: Timestamp: 0xd6ced080
47e8.47ec: SizeOfImage: 0x1e000 (122880)
47e8.47ec: Resource Dir: 0x1d000 LB 0x408
0x409)]
47e8.47ec: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved
0x0)]
47e8.47ec: FileDescription: ApiSet Schema DLL
47e8.47ec: NtOpenDirectoryObject failed on \Driver: 0xc0000022
47e8.47ec: supR3HardenedWinFindAdversaries: 0x0
47e8.47ec: Calling main()
47e8.47ec: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x2
47e8.47ec: '\Device\HarddiskVolume3\Program
47e8.47ec: SUPR3HardenedMain: Final process, opening VBoxDrv...
47e8.47ec: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000600000 LB 0x400000)
47e8.47ec: supR3HardNtEnableThreadCreationEx:
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll)
Files\Oracle\VirtualBox\VBoxSupLib.dll
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxSupLib.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status
24202 (0x5e8a)) on \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxSupLib.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8adcc0000 LB
0x00005000 E:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL [fFlags=0x0]
47e8.47ec: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 24202
(0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSupLib.dll
[lacks WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8adcc0000
'E:\Program Files\Oracle\VirtualBox\VBoxSupLib.DLL'
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcrt.dll'.
'msasn1.dll'.
'crypt32.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\wintrust.dll)
\Device\HarddiskVolume6\Windows\System32\wintrust.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'rpcrt4.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' ->
(\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll)
'crypt32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
'msasn1.dll'.
(\Device\HarddiskVolume6\Windows\System32\crypt32.dll)
\Device\HarddiskVolume6\Windows\System32\crypt32.dll
'msasn1.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' ->
'\Device\HarddiskVolume6\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\msasn1.dll)
\Device\HarddiskVolume6\Windows\System32\msasn1.dll
'msvcrt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' ->
'\Device\HarddiskVolume6\Windows\System32\msvcrt.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\msvcrt.dll)
\Device\HarddiskVolume6\Windows\System32\msvcrt.dll
'msasn1.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msasn1.dll' ->
'\Device\HarddiskVolume6\Windows\System32\msasn1.dll' [rcNtRedir=0xc0150008]
47e8.47ec: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll
(rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags>
[calling]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b4cb0000 LB
0x0009e000 C:\WINDOWS\System32\msvcrt.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\msvcrt.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b3010000 LB
0x00012000 C:\WINDOWS\System32\MSASN1.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\msasn1.dll [lacks WinVerifyTrust]
0x000fa000 C:\WINDOWS\System32\ucrtbase.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\ucrtbase.dll)
\Device\HarddiskVolume6\Windows\System32\ucrtbase.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b30d0000 LB
0x00149000 C:\WINDOWS\System32\CRYPT32.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\crypt32.dll [lacks WinVerifyTrust]
0x00120000 C:\WINDOWS\System32\RPCRT4.dll [fFlags=0x0]
0x0005c000 C:\WINDOWS\System32\Wintrust.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-
synch-l1-2-0) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-synch-l1-2-0
(rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b35c0000
'api-ms-win-core-synch-l1-2-0'
fibers-l1-1-1) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-fibers-l1-1-1
'api-ms-win-core-fibers-l1-1-1'
localization-l1-2-1) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-l1-
2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags>
[calling]
'api-ms-win-core-localization-l1-2-1'
'C:\WINDOWS\system32\Wintrust.dll'
(\Device\HarddiskVolume6\Windows\System32\bcrypt.dll)
\Device\HarddiskVolume6\Windows\System32\bcrypt.dll
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\bcrypt.dll
[calling]
0x00026000 C:\WINDOWS\System32\bcrypt.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b3950000
'C:\WINDOWS\system32\bcrypt.dll'
47e8.47ec: bcrypt.dll loaded at 00007ff8b3950000, BCryptOpenAlgorithmProvider at
00007ff8b3954c70, preloading providers:
(\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll)
\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll
47e8.47ec: supR3HardenedMonitor_LdrLoadDll:
pName=C:\WINDOWS\system32\bcryptprimitives.dll (rcNtResolve=0xc0150008)
*pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
0x00081000 C:\WINDOWS\System32\bcryptprimitives.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll [lacks
WinVerifyTrust]
'C:\WINDOWS\system32\bcryptprimitives.dll'
47e8.47ec: BCryptOpenAlgorithmProvider(,'MD2',0,0) -> 0x0
(hAlgo=0000000000b9a340)
(hAlgo=0000000000b9f6e0)
(hAlgo=0000000000b9f9e0)
47e8.47ec: BCryptOpenAlgorithmProvider(,'SHA1',0,0) -> 0x0
(hAlgo=0000000000b9fce0)
(hAlgo=0000000000b9ffe0)
(hAlgo=0000000000ba02e0)
47e8.47ec: BCryptOpenAlgorithmProvider(,'RSA',0,0) -> 0x0
(hAlgo=0000000000ba05e0)
47e8.47ec: BCryptOpenAlgorithmProvider(,'DSA',0,0) -> 0x0
(hAlgo=0000000000ba08e0)
0x00017000 C:\WINDOWS\System32\CRYPTSP.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\cryptsp.dll)
\Device\HarddiskVolume6\Windows\System32\cryptsp.dll
'bcrypt.dll'.
(\Device\HarddiskVolume6\Windows\System32\rsaenh.dll)
\Device\HarddiskVolume6\Windows\System32\rsaenh.dll
'bcrypt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' ->
'\Device\HarddiskVolume6\Windows\System32\bcrypt.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\bcrypt.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll
[calling]
47e8.47ec: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\rsaenh.dll [lacks WinVerifyTrust]
0x00033000 C:\WINDOWS\system32\rsaenh.dll [fFlags=0x0]
'C:\WINDOWS\system32\rsaenh.dll'
'bcryptprimitives.dll'.
(\Device\HarddiskVolume6\Windows\System32\cryptbase.dll)
\Device\HarddiskVolume6\Windows\System32\cryptbase.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b2a20000 LB
0x0000c000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\cryptbase.dll [lacks WinVerifyTrust]
'bcryptprimitives.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcryptprimitives.dll' ->
'\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll'
[rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll [lacks
WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\kernel32.dll
(Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\kernel32.dll'
\Device\HarddiskVolume6\Windows\System32\wintrust.dll [lacks WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\WINTRUST.DLL
(Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\WINTRUST.DLL'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\CRYPT32.dll
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b30d0000
'C:\WINDOWS\System32\CRYPT32.dll'
0x0001d000 C:\WINDOWS\System32\imagehlp.dll [fFlags=0x0]
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\imagehlp.dll)
\Device\HarddiskVolume6\Windows\System32\imagehlp.dll
'rpcrt4.dll'...
[calling]
0x00097000 C:\WINDOWS\System32\sechost.dll [fFlags=0x0]
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\sechost.dll)
\Device\HarddiskVolume6\Windows\System32\sechost.dll
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\gpapi.dll)
\Device\HarddiskVolume6\Windows\System32\gpapi.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b1bf0000 LB
0x00022000 C:\WINDOWS\SYSTEM32\gpapi.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\gpapi.dll [lacks WinVerifyTrust]
0x00023000 C:\WINDOWS\System32\profapi.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\profapi.dll)
\Device\HarddiskVolume6\Windows\System32\profapi.dll
'msvcrt.dll'.
'crypt32.dll'.
(\Device\HarddiskVolume6\Windows\System32\cryptnet.dll)
\Device\HarddiskVolume6\Windows\System32\cryptnet.dll
'crypt32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'crypt32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\crypt32.dll' [rcNtRedir=0xc0150008]
'msvcrt.dll'...
'rpcrt4.dll'...
'msvcrt.dll'...
'rpcrt4.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\cryptnet.dll
(Input=cryptnet.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
22900 (0x5974)) on \Device\HarddiskVolume6\Windows\System32\cryptnet.dll [lacks
WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8ab000000 LB
0x0002f000 C:\WINDOWS\System32\cryptnet.dll [fFlags=0x0]
(0x5974)) on \Device\HarddiskVolume6\Windows\System32\cryptnet.dll [lacks
WinVerifyTrust]
WinVerifyTrust]
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ab000000
'C:\WINDOWS\System32\cryptnet.dll'
WinVerifyTrust]
[calling]
WinVerifyTrust]
[calling]
WinVerifyTrust]
[calling]
WinVerifyTrust]
[calling]
WinVerifyTrust]
[calling]
WinVerifyTrust]
WinVerifyTrust]
WinVerifyTrust]
WinVerifyTrust]
WinVerifyTrust]
WinVerifyTrust]
'C:\Windows\System32\cryptnet.dll'
0x000a3000 C:\WINDOWS\System32\advapi32.dll [fFlags=0x0]
'msvcrt.dll'.
'sechost.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\advapi32.dll)
\Device\HarddiskVolume6\Windows\System32\advapi32.dll
'rpcrt4.dll'...
'sechost.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'sechost.dll' ->
'\Device\HarddiskVolume6\Windows\System32\sechost.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\sechost.dll [lacks WinVerifyTrust]
'msvcrt.dll'...
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\crypt32.dll
(Input=crypt32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\crypt32.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000000
pwszName=\SystemRoot\System32\ntdll.dll
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: New context 000000000127af90
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000000127af90
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20
wszDigest=F0BC8053E84666DD00B73F2861A22FB7C33BA49B
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\rpcrt4.dll
(Input=rpcrt4.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\rpcrt4.dll'
[calling]
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0;
cat='C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-
Windows-Client-Desktop-Required-
Package0416~31bf3856ad364e35~amd64~~10.0.18362.1198.cat';
file='\SystemRoot\System32\ntdll.dll'
47e8.47ec: g_pfnWinVerifyTrust=00007ff8b41b1d30
47e8.47ec: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\crypt32.dll [redoing WinVerifyTrust]
[calling]
47e8.47ec: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for
'\Device\HarddiskVolume6\Windows\System32\crypt32.dll'
47e8.47ec: supR3HardenedScreenImage/preload: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume6\Windows\System32\wintrust.dll [redoing WinVerifyTrust]
[calling]
47e8.47ec: supR3HardenedScreenImage/preload: 0 (was 0) fWinVerifyTrust=1 for
'\Device\HarddiskVolume6\Windows\System32\wintrust.dll'
[calling]
47e8.47ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1
for '\Device\HarddiskVolume6\Windows\System32\advapi32.dll'
pwszName=\Device\HarddiskVolume6\Windows\System32\cryptnet.dll
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000000127af90
wszDigest=09032EBC3D9D9BDDC0EE4A6463C043296B79FF20
file='\Device\HarddiskVolume6\Windows\System32\cryptnet.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
47e8.47ec: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 22900)
fWinVerifyTrust=1 for '\Device\HarddiskVolume6\Windows\System32\cryptnet.dll'
for '\Device\HarddiskVolume6\Windows\System32\profapi.dll'
for '\Device\HarddiskVolume6\Windows\System32\gpapi.dll'
for '\Device\HarddiskVolume6\Windows\System32\sechost.dll'
for '\Device\HarddiskVolume6\Windows\System32\imagehlp.dll'
for '\Device\HarddiskVolume6\Windows\System32\cryptbase.dll'
for '\Device\HarddiskVolume6\Windows\System32\rsaenh.dll'
[calling]
for '\Device\HarddiskVolume6\Windows\System32\cryptsp.dll'
for '\Device\HarddiskVolume6\Windows\System32\bcryptprimitives.dll'
for '\Device\HarddiskVolume6\Windows\System32\bcrypt.dll'
for '\Device\HarddiskVolume6\Windows\System32\ucrtbase.dll'
for '\Device\HarddiskVolume6\Windows\System32\msvcrt.dll'
for '\Device\HarddiskVolume6\Windows\System32\msasn1.dll'
for '\Device\HarddiskVolume6\Windows\System32\rpcrt4.dll'
fWinVerifyTrust=1 for '\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxSupLib.dll'
Files\Oracle\VirtualBox\VirtualBoxVM.exe'
for '\Device\HarddiskVolume6\Windows\System32\KernelBase.dll'
for '\Device\HarddiskVolume6\Windows\System32\kernel32.dll'
'C:\WINDOWS\system32\crypt32.dll'
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xba02d0ab12c5ed00 CN=XBL Client
IPsec Issuing CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE,
O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x5ad46780fa5df300 DC=com,
DC=microsoft, CN=Microsoft Root Certificate Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xea5386456178582b C=ZA,
ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte
Timestamping CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3be670c1bd02a900 OU=Copyright
(c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xe991ee72b03db500 C=US,
O=Symantec Corporation, CN=Symantec Enterprise Mobile Root for Microsoft
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x4d3835aa4180b200 C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate
Authority 2011
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x646e3fe3ba08df00 C=US, O=MSFT,
CN=Microsoft Authenticode(tm) Root Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x9546d06a8d70b800 CN=XBL Server
IPsec Issuing CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xece4e4289e08b900 C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate
Authority 2010
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf3bb4d7e894b420 C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC TS Root
Certificate Authority 2018
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x43a9cc371ff5385a O=Microsoft
Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root,
OU=Copyright (c) 1997 Microsoft Corp.
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x2e2d2c7c68f0202e O=VeriSign
Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO
LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xcec3d46562b9be8e C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Product Root
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xca58a05dd401ae00 C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time Stamp Root
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x2ca429a5c4c6a700 C=IT,
L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x91e3728b8b40d000 C=GB,
ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x6e864c7a8071ba00 C=ES, O=FNMT-
RCM, OU=AC RAIZ FNMT-RCM
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x61a3a33f81aace00 C=US, ST=UT,
L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-
USERFirst-Object
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x50bb81640c01cb00 C=TW,
O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x6b7bdc34cd37bb00 C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x57ba5395b561bf00 C=BM,
O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf4fd306318ccda00 C=US,
O=GeoTrust Inc., CN=GeoTrust Global CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x83085097e9afdf00 O=Digital
Signature Trust Co., CN=DST Root CA X3
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x266e9b638ffac00 C=HK,
O=Hongkong Post, CN=Hongkong Post Root CA 1
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x780679907625cc00 OU=GlobalSign
Root CA - R3, O=GlobalSign, CN=GlobalSign
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3d98ab22bb04a300 C=IE,
O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa0ee62086758b15d C=US,
O=Equifax, OU=Equifax Secure Certificate Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xeae16ef49d40be00 C=GB,
ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc6536f24d57ae723 C=US, ST=New
Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x9403a4b8727eb000 C=TW,
O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3714f47324e8ad00 C=US,
O=Internet Security Research Group, CN=ISRG Root X1
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd944bca189a00 C=BM, O=QuoVadis
Limited, CN=QuoVadis Root CA 2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x1591b8ac8dcabd00 C=CN,
O=WoSign CA Limited, CN=Certification Authority of WoSign
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x8ff6fc03c1edbd00 C=US,
ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root
Certificate Authority - G2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc6fa4243b695b600 C=US,
O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006
Entrust, Inc., CN=Entrust Root Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa3ce8d99e60eda00 C=BE,
O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x560ad29254e89100 C=GB,
ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa671e9fec832b700 C=US,
O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xa8de7211e13be200 C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x7ae89c50f0b6a00f C=US, O=GTE
Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd45980fbf0a0ac00 C=US,
O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For
authorized use only, CN=thawte Primary Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc9edb72b684ba00 C=US,
O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. -
for authorized use only, CN=Entrust Root Certification Authority - G2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf5cd95e581a4ab00 C=US,
O=SecureTrust Corporation, CN=SecureTrust CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x6f2ebe0e24cfa600 OU=GlobalSign
Root CA - R2, O=GlobalSign, CN=GlobalSign
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x14018a1bf29e595c C=US,
O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x88db8dee0f25e100 C=TW,
O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x7c4fd32ec1b1ce00 C=PL,
O=Unizeto Sp. z o.o., CN=Certum CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xd4fbe673e5ccc600 C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb352b1523915d000 C=JP, O=SECOM
Trust Systems CO.,LTD., OU=Security Communication RootCA2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x16e64d2a56ccf200 C=US,
ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc.,
OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root
Certificate Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x73e85f1bda5faa00 C=DE, O=T-
Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec
GlobalRoot Class 2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xef477acf4ab2d300 C=DE, O=D-
Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x1b8578514b74ac00 C=US, O=WFA
Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - 03
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb28612a94b4dad00
O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c)
1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x357a29080824af00 C=US,
O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For
authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority -
G5
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x59faf1086271bf00 C=US,
ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate
Authority - G2
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x466cbc09db88c100 C=IL,
O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb16dd37ffeb3b300 C=JP, O=SECOM
Trust.net, OU=Security Communication RootCA1
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x3401b15e3761c700 C=US,
authorized use only, CN=VeriSign Universal Root Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc30e361765128000 C=US, ST=New
Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification
Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x491857ead79dde00 C=US, O=The
Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xab549401526569d3 L=Internet,
O=VeriSign, Inc., OU=VeriSign Commercial Software Publishers CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xb9ff821d139e9bf OU=GlobalSign
ECC Root CA - R5, O=GlobalSign, CN=GlobalSign
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x1f78fc529cbacb00 C=US,
authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority -
G3
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xdc1801b225aea100 C=BM,
O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xc2ba72a37dfbe300 C=PL,
O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted
Network CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0x8043e4ce150ead00 C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
47e8.47ec: supR3HardenedWinIsDesiredRootCA: Adding 0xf2e6331af7b700 C=SE,
O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
47e8.47ec: supR3HardenedWinRetrieveTrustedRootCAs: cAdded=70
47e8.47ec: SUPR3HardenedMain: Load Runtime...
'msvcr100.dll'.
'msvcp100.dll'.
'rpcrt4.dll'.
'ws2_32.dll'.
47e8.47ec: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxRT.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxRT.dll
'ws2_32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\ws2_32.dll' [rcNtRedir=0xc0150008]
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\ws2_32.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\ws2_32.dll
'rpcrt4.dll'...
'msvcp100.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll'
'rpcrt4.dll'...
'msvcr100.dll'.
Files\Oracle\VirtualBox\msvcp100.dll) WinVerifyTrust
Files\Oracle\VirtualBox\msvcp100.dll
'msvcr100.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'
'msvcr100.dll'...
47e8.47ec: Detected WinVerifyTrust recursion: rc=Unknown Status 24202 (0x5e8a)
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll'.
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll)
Files\Oracle\VirtualBox\msvcr100.dll
Files\Oracle\VirtualBox\msvcr100.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxRT.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
pwszSearchPath=0000000000000a01:<flags> [calling]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxRT.dll
Files\Oracle\VirtualBox\msvcr100.dll [avoiding WinVerifyTrust]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcp100.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 000000006c430000 LB
0x000d2000 E:\Program Files\Oracle\VirtualBox\MSVCR100.dll [fFlags=0x0]
(0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
[avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 000000006be20000 LB
0x00098000 E:\Program Files\Oracle\VirtualBox\MSVCP100.dll [fFlags=0x0]
0x0006f000 C:\WINDOWS\System32\WS2_32.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff872470000 LB
0x005e9000 E:\Program Files\Oracle\VirtualBox\VBoxRT.dll [fFlags=0x0]
47e8.47ec: Detected loader lock ownership: rc=Unknown Status 24202 (0x5e8a)
Files\Oracle\VirtualBox\msvcr100.dll' [rescheduled]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff872470000
'E:\Program Files\Oracle\VirtualBox\VBoxRT.dll'
Files\Oracle\VirtualBox\msvcr100.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Wintrust.dll
[calling]
'C:\WINDOWS\system32\Wintrust.dll'
[calling]
'C:\WINDOWS\system32\crypt32.dll'
47e8.47ec: SUPR3HardenedMain: Load TrustedMain...
'opengl32.dll'.
'uicommon.dll'.
'vboxrt.dll'.
'msvcp100.dll'.
'msvcr100.dll'.
'qt5corevbox.dll'.
'qt5guivbox.dll'.
'qt5widgetsvbox.dll'.
'qt5openglvbox.dll'.
'user32.dll'.
'ole32.dll'.
'oleaut32.dll'.
'winmm.dll'.
Files\Oracle\VirtualBox\VirtualBoxVM.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VirtualBoxVM.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' ->
'\Device\HarddiskVolume6\Windows\System32\winmm.dll' [rcNtRedir=0xc0150008]
'winmmbase.dll'.
'msvcrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\winmm.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\winmm.dll
'oleaut32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\oleaut32.dll' [rcNtRedir=0xc0150008]
'msvcrt.dll'...
'winmmbase.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' ->
'\Device\HarddiskVolume6\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
47e8.47ec: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS
'\Device\HarddiskVolume6\Windows\System32\winmmbase.dll'.
'msvcrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\winmmbase.dll)
\Device\HarddiskVolume6\Windows\System32\winmmbase.dll
'msvcrt.dll'...
'msvcp_win.dll'.
'combase.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\oleaut32.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\oleaut32.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\ole32.dll' [rcNtRedir=0xc0150008]
'rpcrt4.dll'...
'combase.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' ->
'\Device\HarddiskVolume6\Windows\System32\combase.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\combase.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\combase.dll)
\Device\HarddiskVolume6\Windows\System32\combase.dll
'msvcp_win.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' ->
'\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll'.
(\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll)
\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll
'rpcrt4.dll'...
'rpcrt4.dll'.
'gdi32.dll'.
'user32.dll'.
'combase.dll'.
(\Device\HarddiskVolume6\Windows\System32\ole32.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\ole32.dll
'user32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\user32.dll' [rcNtRedir=0xc0150008]
'combase.dll'...
\Device\HarddiskVolume6\Windows\System32\combase.dll [lacks WinVerifyTrust]
'user32.dll'...
'\Device\HarddiskVolume6\Windows\System32\user32.dll'.
'win32u.dll'.
'gdi32.dll'.
(\Device\HarddiskVolume6\Windows\System32\user32.dll)
\Device\HarddiskVolume6\Windows\System32\user32.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'gdi32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'gdi32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\gdi32.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\gdi32.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\gdi32.dll)
\Device\HarddiskVolume6\Windows\System32\gdi32.dll
'rpcrt4.dll'...
'win32u.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' ->
'\Device\HarddiskVolume6\Windows\System32\win32u.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\win32u.dll'.
47e8.47ec: '\Device\HarddiskVolume6\Windows\System32\win32u.dll' has no imports
(\Device\HarddiskVolume6\Windows\System32\win32u.dll)
\Device\HarddiskVolume6\Windows\System32\win32u.dll
\Device\HarddiskVolume6\Windows\System32\gdi32.dll [lacks WinVerifyTrust]
'win32u.dll'...
\Device\HarddiskVolume6\Windows\System32\win32u.dll [lacks WinVerifyTrust]
'win32u.dll'.
'gdi32.dll'.
(\Device\HarddiskVolume6\Windows\System32\user32.dll) WinVerifyTrust
'qt5openglvbox.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5openglvbox.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5openglvbox.dll'
'win32u.dll'...
\Device\HarddiskVolume6\Windows\System32\win32u.dll [lacks WinVerifyTrust]
'qt5guivbox.dll'.
'qt5corevbox.dll'.
'msvcr100.dll'.
Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll) WinVerifyTrust
Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
'qt5widgetsvbox.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5widgetsvbox.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5widgetsvbox.dll'
'msvcr100.dll'...
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\msvcr100.dll
'qt5corevbox.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5corevbox.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5corevbox.dll'
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'.
'user32.dll'.
'shell32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'ole32.dll'.
'advapi32.dll'.
'ws2_32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'mpr.dll'.
'msvcp100.dll'.
'msvcr100.dll'.
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll)
Files\Oracle\VirtualBox\Qt5CoreVBox.dll
'qt5guivbox.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'qt5guivbox.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\qt5guivbox.dll'
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'.
'opengl32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'gdi32.dll'.
'user32.dll'.
'qt5corevbox.dll'.
'msvcp100.dll'.
'msvcr100.dll'.
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll)
Files\Oracle\VirtualBox\Qt5GuiVBox.dll
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'.
'user32.dll'.
'qt5guivbox.dll'.
'qt5corevbox.dll'.
'shell32.dll'.
'msvcp100.dll'.
'msvcr100.dll'.
(\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll)
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll
'msvcr100.dll'...
'msvcp100.dll'...
'shell32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'shell32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\shell32.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\shell32.dll'.
'user32.dll'.
'gdi32.dll'.
(\Device\HarddiskVolume6\Windows\System32\shell32.dll)
\Device\HarddiskVolume6\Windows\System32\shell32.dll
47e8.47ec: supR3HardenedScreenImage/Imports: cache hit (Unknown Status 24202
(0x5e8a)) on \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\Qt5CoreVBox.dll [lacks WinVerifyTrust]
'qt5guivbox.dll'...
(0x5e8a)) on \Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
'user32.dll'...
\Device\HarddiskVolume6\Windows\System32\user32.dll [lacks WinVerifyTrust]
'msvcr100.dll'...
'msvcp100.dll'...
'user32.dll'...
'opengl32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'opengl32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\opengl32.dll' [rcNtRedir=0xc0150008]
47e8.47ec: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974)
'\Device\HarddiskVolume6\Windows\System32\opengl32.dll'.
'msvcrt.dll'.
'advapi32.dll'.
'user32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'glu32.dll'.
(\Device\HarddiskVolume6\Windows\System32\opengl32.dll)
\Device\HarddiskVolume6\Windows\System32\opengl32.dll
'msvcr100.dll'...
'msvcp100.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'mpr.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'mpr.dll' ->
'\Device\HarddiskVolume6\Windows\System32\mpr.dll' [rcNtRedir=0xc0150008]
'\Device\HarddiskVolume6\Windows\System32\mpr.dll'.
(\Device\HarddiskVolume6\Windows\System32\mpr.dll)
\Device\HarddiskVolume6\Windows\System32\mpr.dll
'ws2_32.dll'...
'advapi32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\advapi32.dll' [rcNtRedir=0xc0150008]
'shell32.dll'...
\Device\HarddiskVolume6\Windows\System32\shell32.dll [lacks WinVerifyTrust]
'user32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'glu32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'glu32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\glu32.dll' [rcNtRedir=0xc0150008]
47e8.47ec: Detected WinVerifyTrust recursion: rc=Unknown Status 22900 (0x5974)
'\Device\HarddiskVolume6\Windows\System32\glu32.dll'.
'msvcrt.dll'.
'user32.dll'.
'opengl32.dll'.
(\Device\HarddiskVolume6\Windows\System32\glu32.dll)
\Device\HarddiskVolume6\Windows\System32\glu32.dll
'user32.dll'...
'advapi32.dll'...
'msvcrt.dll'...
'user32.dll'...
'opengl32.dll'...
(0x5974)) on \Device\HarddiskVolume6\Windows\System32\opengl32.dll [lacks
WinVerifyTrust]
'user32.dll'...
'msvcrt.dll'...
'user32.dll'.
'qt5guivbox.dll'.
'qt5corevbox.dll'.
'shell32.dll'.
'msvcp100.dll'.
'msvcr100.dll'.
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll) WinVerifyTrust
'qt5guivbox.dll'...
[redoing WinVerifyTrust]
'msvcr100.dll'...
'msvcp100.dll'...
'shell32.dll'...
\Device\HarddiskVolume6\Windows\System32\shell32.dll [lacks WinVerifyTrust]
'qt5guivbox.dll'...
'user32.dll'...
47e8.47ec: supR3HardenedScreenImage/Imports: 0 (was 24202) fWinVerifyTrust=1 for
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll'
Files\Oracle\VirtualBox\Qt5CoreVBox.dll [redoing WinVerifyTrust]
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll'
'msvcr100.dll'...
'msvcp100.dll'...
'vboxrt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxrt.dll'
'uicommon.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'uicommon.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\uicommon.dll'
'vboxrt.dll'.
'msvcr100.dll'.
'qt5corevbox.dll'.
'qt5guivbox.dll'.
'user32.dll'.
'advapi32.dll'.
'oleaut32.dll'.
'rpcrt4.dll'.
Files\Oracle\VirtualBox\UICommon.dll) WinVerifyTrust
Files\Oracle\VirtualBox\UICommon.dll
'opengl32.dll'...
(0x5974)) on \Device\HarddiskVolume6\Windows\System32\opengl32.dll [redoing
WinVerifyTrust]
pwszName=\Device\HarddiskVolume6\Windows\System32\opengl32.dll
wszDigest=0837440FAE05EB650168FFA2D15E73182F6A3A26
'rpcrt4.dll'...
'oleaut32.dll'...
'advapi32.dll'...
'user32.dll'...
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [lacks WinVerifyTrust]
'qt5guivbox.dll'...
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll
'msvcr100.dll'...
'vboxrt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.18362.1171.cat';
file='\Device\HarddiskVolume6\Windows\System32\opengl32.dll'
'\Device\HarddiskVolume6\Windows\System32\opengl32.dll'
Files\Oracle\VirtualBox\VirtualBoxVM.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
pwszSearchPath=0000000000000a01:<flags> [calling]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
22900 (0x5974)) on \Device\HarddiskVolume6\Windows\System32\glu32.dll [avoiding
WinVerifyTrust]
\Device\HarddiskVolume6\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
\Device\HarddiskVolume6\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
'msvcp_win.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\DXCore.dll)
\Device\HarddiskVolume6\Windows\System32\DXCore.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b32f0000 LB
0x00021000 C:\WINDOWS\System32\win32u.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\win32u.dll [avoiding WinVerifyTrust]
0x0009e000 C:\WINDOWS\System32\msvcp_win.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll [avoiding WinVerifyTrust]
0x00196000 C:\WINDOWS\System32\gdi32full.dll [fFlags=0x0]
'msvcp_win.dll'.
'gdi32.dll'.
'user32.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\gdi32full.dll)
\Device\HarddiskVolume6\Windows\System32\gdi32full.dll
0x00026000 C:\WINDOWS\System32\GDI32.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\gdi32.dll [avoiding WinVerifyTrust]
0x00194000 C:\WINDOWS\System32\USER32.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\user32.dll [avoiding WinVerifyTrust]
0x00336000 C:\WINDOWS\System32\combase.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\combase.dll [avoiding WinVerifyTrust]
0x0004a000 C:\WINDOWS\System32\cfgmgr32.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll)
\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll
0x00020000 C:\WINDOWS\SYSTEM32\dxcore.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\DXCore.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89d840000 LB
0x0002c000 C:\WINDOWS\SYSTEM32\GLU32.dll [fFlags=0x0]
(0x5974)) on \Device\HarddiskVolume6\Windows\System32\glu32.dll [avoiding
WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89e210000 LB
0x00156000 C:\WINDOWS\SYSTEM32\OPENGL32.dll [fFlags=0x0]
0x000a9000 C:\WINDOWS\System32\shcore.dll [fFlags=0x0]
'msvcrt.dll'.
'rpcrt4.dll'.
'combase.dll'.
(\Device\HarddiskVolume6\Windows\System32\SHCore.dll)
\Device\HarddiskVolume6\Windows\System32\SHCore.dll
0x00010000 C:\WINDOWS\System32\UMPDC.dll [fFlags=0x0]
(\Device\HarddiskVolume6\Windows\System32\umpdc.dll)
\Device\HarddiskVolume6\Windows\System32\umpdc.dll
0x0004a000 C:\WINDOWS\System32\powrprof.dll [fFlags=0x0]
'rpcrt4.dll'.
'umpdc.dll'.
(\Device\HarddiskVolume6\Windows\System32\powrprof.dll)
\Device\HarddiskVolume6\Windows\System32\powrprof.dll
0x00052000 C:\WINDOWS\System32\shlwapi.dll [fFlags=0x0]
'msvcrt.dll'.
'gdi32.dll'.
'user32.dll'.
(\Device\HarddiskVolume6\Windows\System32\shlwapi.dll)
\Device\HarddiskVolume6\Windows\System32\shlwapi.dll
0x00011000 C:\WINDOWS\System32\kernel.appcore.dll [fFlags=0x0]
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\kernel.appcore.dll)
\Device\HarddiskVolume6\Windows\System32\kernel.appcore.dll
0x00781000 C:\WINDOWS\System32\windows.storage.dll [fFlags=0x0]
'combase.dll'.
'msvcp_win.dll'.
'rpcrt4.dll'.
'profapi.dll'.
(\Device\HarddiskVolume6\Windows\System32\windows.storage.dll)
\Device\HarddiskVolume6\Windows\System32\windows.storage.dll
0x006e7000 C:\WINDOWS\System32\SHELL32.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\shell32.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b4e50000 LB
0x00157000 C:\WINDOWS\System32\ole32.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff88c970000 LB
0x0001b000 C:\WINDOWS\SYSTEM32\MPR.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\mpr.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 000000006bec0000 LB
0x00565000 E:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8714a0000 LB
0x005f7000 E:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 000000006b8b0000 LB
0x00561000 E:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [fFlags=0x0]
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll [avoiding WinVerifyTrust]
0x000c5000 C:\WINDOWS\System32\OLEAUT32.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff868220000 LB
0x02609000 E:\Program Files\Oracle\VirtualBox\UICommon.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\UICommon.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 000000006e470000 LB
0x00054000 E:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll
0x0002d000 C:\WINDOWS\SYSTEM32\WINMMBASE.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\winmmbase.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b0dc0000 LB
0x00024000 C:\WINDOWS\SYSTEM32\WINMM.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8712d0000 LB
0x001c8000 E:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll
47e8.47ec: Detected loader lock ownership: rc=VINF_SUCCESS
'\Device\HarddiskVolume6\Windows\System32\windows.storage.dll'.
for '\Device\HarddiskVolume6\Windows\System32\windows.storage.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\kernel.appcore.dll'.
for '\Device\HarddiskVolume6\Windows\System32\kernel.appcore.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\shlwapi.dll'.
for '\Device\HarddiskVolume6\Windows\System32\shlwapi.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\powrprof.dll'.
for '\Device\HarddiskVolume6\Windows\System32\powrprof.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\umpdc.dll'.
for '\Device\HarddiskVolume6\Windows\System32\umpdc.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\SHCore.dll'.
for '\Device\HarddiskVolume6\Windows\System32\SHCore.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll'.
for '\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\gdi32full.dll'.
for '\Device\HarddiskVolume6\Windows\System32\gdi32full.dll' [rescheduled]
'\Device\HarddiskVolume6\Windows\System32\DXCore.dll'.
for '\Device\HarddiskVolume6\Windows\System32\DXCore.dll' [rescheduled]
47e8.47ec: Detected loader lock ownership: rc=Unknown Status 22900 (0x5974)
fWinVerifyTrust=0 for '\Device\HarddiskVolume6\Windows\System32\glu32.dll'
[rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\mpr.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\shell32.dll' [rescheduled]
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\win32u.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\gdi32.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\user32.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\combase.dll' [rescheduled]
for '\Device\HarddiskVolume6\Windows\System32\winmmbase.dll' [rescheduled]
'profapi.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
'rpcrt4.dll'...
'msvcp_win.dll'...
\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll [redoing WinVerifyTrust]
47e8.47ec: supR3HardenedScreenImage/Imports: WinVerifyTrust not available,
rescheduling \Device\HarddiskVolume6\Windows\System32\msvcp_win.dll
'combase.dll'...
\Device\HarddiskVolume6\Windows\System32\combase.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\combase.dll
'rpcrt4.dll'...
'msvcrt.dll'...
'user32.dll'...
\Device\HarddiskVolume6\Windows\System32\user32.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\user32.dll
\Device\HarddiskVolume6\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\gdi32.dll
'msvcrt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'umpdc.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'umpdc.dll' ->
'\Device\HarddiskVolume6\Windows\System32\umpdc.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\umpdc.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\umpdc.dll
'rpcrt4.dll'...
'combase.dll'...
\Device\HarddiskVolume6\Windows\System32\combase.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\combase.dll
'rpcrt4.dll'...
'msvcrt.dll'...
'win32u.dll'...
\Device\HarddiskVolume6\Windows\System32\win32u.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\win32u.dll
'user32.dll'...
\Device\HarddiskVolume6\Windows\System32\gdi32.dll [redoing WinVerifyTrust]
rescheduling \Device\HarddiskVolume6\Windows\System32\gdi32.dll
'msvcp_win.dll'...
'win32u.dll'...
'msvcp_win.dll'...
(Input=kernel32, rcNtResolve=0xc0150008) *pfFlags=0x0
[rescheduled]
[rescheduled]
string-l1-1-0) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-string-l1-1-0
'api-ms-win-core-string-l1-1-0'
[rescheduled]
[rescheduled]
datetime-l1-1-1) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-datetime-l1-1-1
'api-ms-win-core-datetime-l1-1-1'
[rescheduled]
[rescheduled]
localization-obsolete-l1-2-0) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-
obsolete-l1-2-0 (rcNtResolve=0x0) *pfFlags=0x0
'api-ms-win-core-localization-obsolete-l1-2-0'
[rescheduled]
[rescheduled]
'\Device\HarddiskVolume6\Windows\System32\imm32.dll'.
'user32.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\imm32.dll)
\Device\HarddiskVolume6\Windows\System32\imm32.dll
'win32u.dll'...
'user32.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\IMM32.DLL
[calling]
0x0002e000 C:\WINDOWS\System32\IMM32.DLL [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\imm32.dll [avoiding WinVerifyTrust]
'C:\WINDOWS\system32\IMM32.DLL'
for '\Device\HarddiskVolume6\Windows\System32\imm32.dll' [rescheduled]
[rescheduled]
[rescheduled]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ADVAPI32.DLL
(Input=ADVAPI32.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\ADVAPI32.DLL'
[rescheduled]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8712d0000
'E:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll'
for '\Device\HarddiskVolume6\Windows\System32\imm32.dll'
for '\Device\HarddiskVolume6\Windows\System32\windows.storage.dll'
for '\Device\HarddiskVolume6\Windows\System32\kernel.appcore.dll'
for '\Device\HarddiskVolume6\Windows\System32\shlwapi.dll'
for '\Device\HarddiskVolume6\Windows\System32\powrprof.dll'
for '\Device\HarddiskVolume6\Windows\System32\umpdc.dll'
for '\Device\HarddiskVolume6\Windows\System32\SHCore.dll'
for '\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll'
for '\Device\HarddiskVolume6\Windows\System32\gdi32full.dll'
for '\Device\HarddiskVolume6\Windows\System32\DXCore.dll'
pwszName=\Device\HarddiskVolume6\Windows\System32\glu32.dll
wszDigest=F356C86D0A2DBA0570D09B39D4AF818DFCB17010
Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.18362.1171.cat';
file='\Device\HarddiskVolume6\Windows\System32\glu32.dll'
for '\Device\HarddiskVolume6\Windows\System32\mpr.dll'
for '\Device\HarddiskVolume6\Windows\System32\shell32.dll'
Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll'
for '\Device\HarddiskVolume6\Windows\System32\win32u.dll'
for '\Device\HarddiskVolume6\Windows\System32\gdi32.dll'
for '\Device\HarddiskVolume6\Windows\System32\user32.dll'
for '\Device\HarddiskVolume6\Windows\System32\msvcp_win.dll'
for '\Device\HarddiskVolume6\Windows\System32\combase.dll'
[calling]
for '\Device\HarddiskVolume6\Windows\System32\winmmbase.dll'
47e8.47ec: SUPR3HardenedMain: Calling TrustedMain (00007ff8712d16c0)...
'user32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'imm32.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'winmm.dll'.
'oleaut32.dll'.
'shell32.dll'.
'advapi32.dll'.
'qt5guivbox.dll'.
'qt5corevbox.dll'.
'msvcr100.dll'.
Files\Oracle\VirtualBox\platforms\qwindows.dll) WinVerifyTrust
Files\Oracle\VirtualBox\platforms\qwindows.dll
'msvcr100.dll'...
'qt5guivbox.dll'...
'advapi32.dll'...
'shell32.dll'...
'oleaut32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' ->
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
'user32.dll'...
Files\Oracle\VirtualBox\platforms\qwindows.dll (rcNtResolve=0xc0150008)
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff874db0000 LB
0x0012e000 E:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\platforms\qwindows.dll
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff874db0000
'E:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll'
pwszName=\Device\HarddiskVolume6\Windows\System32\uxtheme.dll
wszDigest=286AD1CEC16EFDCA5718925D19E68A486A5851A0
file='\Device\HarddiskVolume6\Windows\System32\uxtheme.dll'
'msvcrt.dll'.
'gdi32.dll'.
'user32.dll'.
(\Device\HarddiskVolume6\Windows\System32\uxtheme.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\uxtheme.dll
'user32.dll'...
'msvcrt.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll
[calling]
0x00099000 C:\WINDOWS\system32\uxtheme.dll [fFlags=0x0]
'C:\WINDOWS\system32\uxtheme.dll'
'C:\WINDOWS\system32\user32.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\shell32.dll
[calling]
'C:\WINDOWS\system32\shell32.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\SHCore.dll
[calling]
'C:\WINDOWS\system32\SHCore.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: error opening
'C:\WINDOWS\system32\wintab32.dll': 0 (NtPath=\??\C:\WINDOWS\system32\wintab32.dll;
Input=C:\WINDOWS\system32\wintab32.dll; rcNtGetDll=0x0
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034
'C:\WINDOWS\system32\wintab32.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0dc0000
'C:\WINDOWS\system32\winmm.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\winmm.dll
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0dc0000
'C:\WINDOWS\system32\winmm.dll'
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\uxtheme.dll
[calling]
'C:\WINDOWS\system32\uxtheme.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\advapi32.dll
[calling]
'C:\WINDOWS\system32\advapi32.dll'
'rpcrt4.dll'.
'profapi.dll'.
(\Device\HarddiskVolume6\Windows\System32\userenv.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\userenv.dll
'profapi.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'profapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\profapi.dll' [rcNtRedir=0xc0150008]
'rpcrt4.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\userenv.dll
[calling]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b2ee0000 LB
0x00025000 C:\WINDOWS\system32\userenv.dll [fFlags=0x0]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b2ee0000
'C:\WINDOWS\system32\userenv.dll'
0x000a2000 C:\WINDOWS\System32\clbcatq.dll [fFlags=0x0]
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\clbcatq.dll)
\Device\HarddiskVolume6\Windows\System32\clbcatq.dll
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'rpcrt4.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' ->
'msvcrt.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' ->
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b30d0000
47e8.3cd0: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1
for '\Device\HarddiskVolume6\Windows\System32\clbcatq.dll'
47e8.3cd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
'msvcp100.dll'.
'vboxrt.dll'.
'advapi32.dll'.
47e8.3cd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
'oleaut32.dll'.
47e8.3cd0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxC.dll) WinVerifyTrust
47e8.3cd0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxC.dll
'oleaut32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' ->
47e8.3cd0: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' ->
'advapi32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' ->
'vboxrt.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'msvcp100.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'msvcr100.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxC.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.3cd0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxC.dll
47e8.3cd0: supR3HardenedDllNotificationCallback: load 00007ff8720c0000 LB
0x003b0000 E:\Program Files\Oracle\VirtualBox\VBoxC.dll [fFlags=0x0]
47e8.3cd0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8720c0000
'E:\Program Files\Oracle\VirtualBox\VBoxC.dll'
'msvcr100.dll'.
'vboxrt.dll'.
'advapi32.dll'.
'shlwapi.dll'.
47e8.3cd0: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #5 'ole32.dll'.
'oleaut32.dll'.
'rpcrt4.dll'.
47e8.3cd0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxProxyStub.dll) WinVerifyTrust
47e8.3cd0: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxProxyStub.dll
'rpcrt4.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' ->
'oleaut32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' ->
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' ->
'shlwapi.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'shlwapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\shlwapi.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\shlwapi.dll
'advapi32.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' ->
'vboxrt.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'msvcr100.dll'...
47e8.3cd0: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxProxyStub.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.3cd0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
47e8.3cd0: supR3HardenedDllNotificationCallback: load 00007ff888900000 LB
0x000ed000 E:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff888900000
'E:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll'
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\oleaut32.dll
[calling]
47e8.3cd0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b5940000
'C:\Windows\System32\oleaut32.dll'
'C:\WINDOWS\system32\gdi32.dll'
[calling]
0x00135000 C:\WINDOWS\System32\MSCTF.dll [fFlags=0x0]
'msvcrt.dll'.
'oleaut32.dll'.
'user32.dll'.
'gdi32.dll'.
'imm32.dll'.
'advapi32.dll'.
(\Device\HarddiskVolume6\Windows\System32\msctf.dll)
\Device\HarddiskVolume6\Windows\System32\msctf.dll
'advapi32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'imm32.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'imm32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\imm32.dll' [rcNtRedir=0xc0150008]
'user32.dll'...
\Device\HarddiskVolume6\Windows\System32\user32.dll
'oleaut32.dll'...
'msvcrt.dll'...
for '\Device\HarddiskVolume6\Windows\System32\msctf.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007c4
pwszName=\Device\HarddiskVolume6\Windows\System32\DataExchange.dll
wszDigest=AF758F581E6ED4B195B000E1E88DA05815FF2C72
file='\Device\HarddiskVolume6\Windows\System32\DataExchange.dll'
'msvcrt.dll'.
'shcore.dll'.
'combase.dll'.
'd3d11.dll'.
'dcomp.dll'.
(\Device\HarddiskVolume6\Windows\System32\DataExchange.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\DataExchange.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dcomp.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'dcomp.dll' ->
'\Device\HarddiskVolume6\Windows\System32\dcomp.dll' [rcNtRedir=0xc0150008]
'win32u.dll'.
'msvcp_win.dll'.
(\Device\HarddiskVolume6\Windows\System32\dcomp.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\dcomp.dll
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'd3d11.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'd3d11.dll' ->
'\Device\HarddiskVolume6\Windows\System32\d3d11.dll' [rcNtRedir=0xc0150008]
'msvcp_win.dll'...
'win32u.dll'...
'msvcrt.dll'.
47e8.47ec: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'dxgi.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\d3d11.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\d3d11.dll
'combase.dll'...
'shcore.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' ->
'\Device\HarddiskVolume6\Windows\System32\shcore.dll' [rcNtRedir=0xc0150008]
'msvcrt.dll'...
'win32u.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'dxgi.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'dxgi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\dxgi.dll' [rcNtRedir=0xc0150008]
'msvcrt.dll'.
'win32u.dll'.
(\Device\HarddiskVolume6\Windows\System32\dxgi.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\dxgi.dll
'msvcrt.dll'...
'win32u.dll'...
'msvcrt.dll'...
pName=C:\WINDOWS\system32\dataexchange.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8b1cd0000 LB
0x000eb000 C:\WINDOWS\system32\dxgi.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8af3b0000 LB
0x0025b000 C:\WINDOWS\system32\d3d11.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8afa70000 LB
0x001dd000 C:\WINDOWS\system32\dcomp.dll [fFlags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8831e0000 LB
0x0003a000 C:\WINDOWS\system32\dataexchange.dll [fFlags=0x0]
'C:\WINDOWS\System32\gdi32.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8831e0000
'C:\WINDOWS\system32\dataexchange.dll'
'rmclient.dll'.
'rpcrt4.dll'.
'combase.dll'.
'msvcp_win.dll'.
(\Device\HarddiskVolume6\Windows\System32\twinapi.appcore.dll)
\Device\HarddiskVolume6\Windows\System32\twinapi.appcore.dll
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\rmclient.dll)
\Device\HarddiskVolume6\Windows\System32\rmclient.dll
0x00029000 C:\WINDOWS\system32\RMCLIENT.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\rmclient.dll [avoiding WinVerifyTrust]
0x00262000 C:\WINDOWS\system32\twinapi.appcore.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\twinapi.appcore.dll [avoiding
WinVerifyTrust]
'rpcrt4.dll'...
'msvcrt.dll'...
'msvcp_win.dll'...
'combase.dll'...
'rpcrt4.dll'...
'rmclient.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'rmclient.dll' ->
'\Device\HarddiskVolume6\Windows\System32\rmclient.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\rmclient.dll [lacks WinVerifyTrust]
for '\Device\HarddiskVolume6\Windows\System32\rmclient.dll'
for '\Device\HarddiskVolume6\Windows\System32\twinapi.appcore.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\Shcore.dll
[calling]
'C:\WINDOWS\system32\Shcore.dll'
'msvcrt.dll'.
'rpcrt4.dll'.
'coreuicomponents.dll'.
'coremessaging.dll'.
(\Device\HarddiskVolume6\Windows\System32\TextInputFramework.dll)
\Device\HarddiskVolume6\Windows\System32\TextInputFramework.dll
'msvcrt.dll'.
'shcore.dll'.
(\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll)
\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll
'msvcrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll)
\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll
(\Device\HarddiskVolume6\Windows\System32\ntmarta.dll)
\Device\HarddiskVolume6\Windows\System32\ntmarta.dll
'combase.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\WinTypes.dll)
\Device\HarddiskVolume6\Windows\System32\WinTypes.dll
0x00031000 C:\WINDOWS\SYSTEM32\ntmarta.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\ntmarta.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8afc50000 LB
0x000d4000 C:\WINDOWS\System32\CoreMessaging.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll [avoiding
WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8ae3b0000 LB
0x00153000 C:\WINDOWS\SYSTEM32\wintypes.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\WinTypes.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8ab080000 LB
0x0032a000 C:\WINDOWS\System32\CoreUIComponents.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll [avoiding
WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8a7e40000 LB
0x0009e000 C:\WINDOWS\System32\TextInputFramework.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\TextInputFramework.dll [avoiding
WinVerifyTrust]
'rpcrt4.dll'...
'combase.dll'...
'msvcrt.dll'...
'shcore.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' ->
'coremessaging.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' ->
'\Device\HarddiskVolume6\Windows\System32\coremessaging.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
'msvcrt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' ->
\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll [lacks WinVerifyTrust]
'coreuicomponents.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' ->
'\Device\HarddiskVolume6\Windows\System32\coreuicomponents.dll'
\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll [lacks
WinVerifyTrust]
'rpcrt4.dll'...
'msvcrt.dll'...
for '\Device\HarddiskVolume6\Windows\System32\WinTypes.dll'
for '\Device\HarddiskVolume6\Windows\System32\ntmarta.dll'
for '\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll'
for '\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll'
for '\Device\HarddiskVolume6\Windows\System32\TextInputFramework.dll'
47e8.47ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-
ntuser-window-ext-l1-1-0.dll) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-window-
ext-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0
'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll'
47e8.47ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-rtcore-
ntuser-integration-l1-1-0.dll) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-rtcore-ntuser-
integration-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0
'ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll'
47e8.47ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(api-ms-win-core-com-
l1-1-0.dll) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-com-l1-1-0.dll
'api-ms-win-core-com-l1-1-0.dll'
'msvcrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\iertutil.dll)
\Device\HarddiskVolume6\Windows\System32\iertutil.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8a2ec0000 LB
0x002a7000 C:\WINDOWS\System32\iertutil.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\iertutil.dll [avoiding WinVerifyTrust]
'msvcrt.dll'...
for '\Device\HarddiskVolume6\Windows\System32\iertutil.dll'
\Device\HarddiskVolume6\Windows\System32\msctf.dll
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MSCTF.dll
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b5f80000
'C:\WINDOWS\System32\MSCTF.dll'
[calling]
[calling]
[calling]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ole32.dll
(Input=ole32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4e50000
'C:\WINDOWS\System32\ole32.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\OLEAUT32.dll
(Input=OLEAUT32.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
'C:\WINDOWS\System32\OLEAUT32.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b84
pwszName=\Device\HarddiskVolume6\Windows\System32\wbem\wbemprox.dll
wszDigest=9079CDC5ACC547B11552509AC18E33929F812DB5
file='\Device\HarddiskVolume6\Windows\System32\wbem\wbemprox.dll'
'msvcrt.dll'.
'ws2_32.dll'.
'wbemcomn.dll'.
(\Device\HarddiskVolume6\Windows\System32\wbem\wbemprox.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\wbem\wbemprox.dll
'wbemcomn.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' ->
'\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000b90
pwszName=\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll
wszDigest=22EAF38FA276D7A374D3945ACD556FA0953D3440
file='\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll'
'msvcrt.dll'.
'bcrypt.dll'.
'ws2_32.dll'.
(\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll
'ws2_32.dll'...
'msvcrt.dll'...
'ws2_32.dll'...
'bcrypt.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' ->
'msvcrt.dll'...
pName=C:\WINDOWS\system32\wbem\wbemprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
0x00084000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [fFlags=0x0]
0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [fFlags=0x0]
47e8.47ec: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(API-MS-Win-Core-
LocalRegistry-L1-1-0.dll) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=API-MS-Win-Core-LocalRegistry-L1-
1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags>
[calling]
'API-MS-Win-Core-LocalRegistry-L1-1-0.dll'
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a0410000
'C:\WINDOWS\system32\wbem\wbemprox.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=00000000000007dc
pwszName=\Device\HarddiskVolume6\Windows\System32\wbem\wbemsvc.dll
wszDigest=B0BE32F19BEEFF7DE547DC04737D42E56F0E4CCB
file='\Device\HarddiskVolume6\Windows\System32\wbem\wbemsvc.dll'
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\wbem\wbemsvc.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\wbem\wbemsvc.dll
'rpcrt4.dll'...
'msvcrt.dll'...
pName=C:\WINDOWS\system32\wbem\wbemsvc.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89f4a0000 LB
0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [fFlags=0x0]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89f4a0000
'C:\WINDOWS\system32\wbem\wbemsvc.dll'
localization-l1-2-0.dll) -> 0x0, fPresent=1
2-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000009:<flags>
[calling]
'api-ms-win-core-localization-l1-2-0.dll'
localization-obsolete-l1-1-0.dll) -> 0x0, fPresent=1
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=api-ms-win-core-localization-
obsolete-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0
'api-ms-win-core-localization-obsolete-l1-1-0.dll'
47e8.47ec: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000ae0
pwszName=\Device\HarddiskVolume6\Windows\System32\wbem\fastprox.dll
wszDigest=0708A64F48237CD4D5092546CE9C373F20B30CA1
file='\Device\HarddiskVolume6\Windows\System32\wbem\fastprox.dll'
'msvcrt.dll'.
'wbemcomn.dll'.
(\Device\HarddiskVolume6\Windows\System32\wbem\fastprox.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\wbem\fastprox.dll
'wbemcomn.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'wbemcomn.dll' ->
'\Device\HarddiskVolume6\Windows\System32\wbemcomn.dll' [rcNtRedir=0xc0150008]
'msvcrt.dll'...
pName=C:\WINDOWS\system32\wbem\fastprox.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89f4c0000 LB
0x00101000 C:\WINDOWS\system32\wbem\fastprox.dll [fFlags=0x0]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89f4c0000
'C:\WINDOWS\system32\wbem\fastprox.dll'
pwszName=\Device\HarddiskVolume6\Windows\System32\amsi.dll
wszDigest=34A0E35947013FDFB8FD53ABB5566986E0303F84
file='\Device\HarddiskVolume6\Windows\System32\amsi.dll'
'msvcrt.dll'.
'rpcrt4.dll'.
'userenv.dll'.
(\Device\HarddiskVolume6\Windows\System32\amsi.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\amsi.dll
'userenv.dll'...
47e8.47ec: supR3HardenedWinVerifyCacheProcessImportTodos: 'userenv.dll' ->
'\Device\HarddiskVolume6\Windows\System32\userenv.dll' [rcNtRedir=0xc0150008]
'rpcrt4.dll'...
'msvcrt.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\amsi.dll
(Input=amsi.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89a0e0000 LB
0x00017000 C:\WINDOWS\System32\amsi.dll [fFlags=0x0]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89a0e0000
'C:\WINDOWS\System32\amsi.dll'
'advapi32.dll'.
'oleaut32.dll'.
(\Device\HarddiskVolume6\ProgramData\Microsoft\Windows
Defender\Platform\4.18.2011.6-0\MpOAV.dll) WinVerifyTrust
\Device\HarddiskVolume6\ProgramData\Microsoft\Windows
Defender\Platform\4.18.2011.6-0\MpOAV.dll
'oleaut32.dll'...
'advapi32.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\ProgramData\Microsoft\Windows
Defender\platform\4.18.2011.6-0\MpOav.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
0x00079000 C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-
0\MpOav.dll [fFlags=0x0]
localization-l1-2-1) -> 0x0, fPresent=1
2-1 (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags>
[calling]
'api-ms-win-core-localization-l1-2-1'
'\Device\HarddiskVolume6\Windows\System32\version.dll'.
'msvcrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\version.dll)
\Device\HarddiskVolume6\Windows\System32\version.dll
'msvcrt.dll'...
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\version.dll
[calling]
\Device\HarddiskVolume6\Windows\System32\version.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8abf80000 LB
0x0000a000 C:\WINDOWS\system32\version.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\version.dll [avoiding WinVerifyTrust]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8abf80000
'C:\WINDOWS\system32\version.dll'
'\Device\HarddiskVolume6\Windows\System32\version.dll'.
for '\Device\HarddiskVolume6\Windows\System32\version.dll' [rescheduled]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff896a80000
'C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpOav.dll'
for '\Device\HarddiskVolume6\Windows\System32\version.dll'
'C:\WINDOWS\System32\ADVAPI32.dll'
47e8.4404: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.4404: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
'vboxrt.dll'.
47e8.4404: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxVMM.dll) WinVerifyTrust
47e8.4404: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxVMM.dll
47e8.4404: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'vboxrt.dll'...
47e8.4404: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'msvcr100.dll'...
47e8.4404: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.4404: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxVMM.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.4404: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxVMM.dll
47e8.4404: supR3HardenedDllNotificationCallback: load 00007ff870f50000 LB
0x0037a000 E:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL [fFlags=0x0]
47e8.4404: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
47e8.4404: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff870f50000
'E:\Program Files\Oracle\VirtualBox\VBoxVMM.DLL'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000d4c
pwszName=\Device\HarddiskVolume6\Windows\System32\NetSetupShim.dll
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: Cached context 000000000127af90
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=000000000127af90
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: cbHash=20
wszDigest=7F5B666FF2CFCD1394E450AF7141F0F82A5730F3
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b30d0000
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => 0x0;
file='\Device\HarddiskVolume6\Windows\System32\NetSetupShim.dll'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile -> 0 (org 22900)
'msvcp_win.dll'.
'rpcrt4.dll'.
'oleaut32.dll'.
'ws2_32.dll'.
'netsetupapi.dll'.
'setupapi.dll'.
'devrtl.dll'.
47e8.758: supHardenedWinVerifyImageByHandle: -> 0
(\Device\HarddiskVolume6\Windows\System32\NetSetupShim.dll) WinVerifyTrust
47e8.758: supR3HardenedWinVerifyCacheInsert:
\Device\HarddiskVolume6\Windows\System32\NetSetupShim.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devrtl.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'devrtl.dll' ->
'\Device\HarddiskVolume6\Windows\System32\devrtl.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000c94
pwszName=\Device\HarddiskVolume6\Windows\System32\devrtl.dll
wszDigest=D2E5A6C3AFA14B1D9C532760FD646C3AC357C7AB
file='\Device\HarddiskVolume6\Windows\System32\devrtl.dll'
(\Device\HarddiskVolume6\Windows\System32\devrtl.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\devrtl.dll
'setupapi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'setupapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\setupapi.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0 'msvcrt.dll'.
'rpcrt4.dll'.
'cfgmgr32.dll'.
'bcrypt.dll'.
(\Device\HarddiskVolume6\Windows\System32\setupapi.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\setupapi.dll
'netsetupapi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'netsetupapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\netsetupapi.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'bcrypt.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'bcrypt.dll' ->
47e8.758: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
'cfgmgr32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' ->
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'msvcrt.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcrt.dll' ->
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\NetSetupApi.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\NetSetupApi.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' ->
'oleaut32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'oleaut32.dll' ->
'msvcp_win.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp_win.dll' ->
47e8.758: supR3HardenedMonitor_LdrLoadDll:
pName=C:\Windows\System32\NetSetupShim.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff89ce20000 LB
0x00025000 C:\Windows\System32\NetSetupApi.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8b4fb0000 LB
0x00470000 C:\WINDOWS\System32\setupapi.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8a2090000 LB
0x00013000 C:\Windows\System32\DEVRTL.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff89a7d0000 LB
0x00081000 C:\Windows\System32\NetSetupShim.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89a7d0000
'C:\Windows\System32\NetSetupShim.dll'
'rpcrt4.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #24 'nsi.dll'.
'winnsi.dll'.
(\Device\HarddiskVolume6\Windows\System32\NetSetupEngine.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\NetSetupEngine.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winnsi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'winnsi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\winnsi.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'rpcrt4.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #4 'nsi.dll'.
(\Device\HarddiskVolume6\Windows\System32\winnsi.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\winnsi.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'nsi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'nsi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\nsi.dll' [rcNtRedir=0xc0150008]
47e8.758: Detected WinVerifyTrust recursion: rc=VINF_SUCCESS
'\Device\HarddiskVolume6\Windows\System32\nsi.dll'.
(\Device\HarddiskVolume6\Windows\System32\nsi.dll)
\Device\HarddiskVolume6\Windows\System32\nsi.dll
(\Device\HarddiskVolume6\Windows\System32\nsi.dll) WinVerifyTrust
47e8.758: supR3HardenedMonitor_LdrLoadDll:
pName=C:\Windows\System32\NetSetupEngine.dll (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8b5430000 LB
0x00008000 C:\WINDOWS\System32\NSI.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\nsi.dll [avoiding WinVerifyTrust]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8abf70000 LB
0x0000b000 C:\WINDOWS\SYSTEM32\WINNSI.DLL [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff874ce0000 LB
0x000ce000 C:\Windows\System32\NetSetupEngine.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff874ce0000
'C:\Windows\System32\NetSetupEngine.dll'
47e8.758: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1
for '\Device\HarddiskVolume6\Windows\System32\nsi.dll'
'msvcr100.dll'.
'msvcp100.dll'.
'vboxvmm.dll'.
'vboxrt.dll'.
'user32.dll'.
Files\Oracle\VirtualBox\VBoxSharedClipboard.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
'user32.dll'...
47e8.4238: supR3HardenedWinVerifyCacheProcessImportTodos: 'user32.dll' ->
'vboxrt.dll'...
'vboxvmm.dll'...
47e8.4238: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxvmm.dll'
'msvcp100.dll'...
47e8.4238: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'msvcr100.dll'...
Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL (rcNtResolve=0xc0150008)
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
47e8.4238: supR3HardenedDllNotificationCallback: load 00007ff8ad990000 LB
0x0000f000 E:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll
47e8.4238: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad990000
'E:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL'
47e8.3b50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.3b50: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
'msvcp100.dll'.
'vboxrt.dll'.
47e8.3b50: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll) WinVerifyTrust
47e8.3b50: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
47e8.3b50: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'vboxrt.dll'...
47e8.3b50: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'msvcp100.dll'...
47e8.3b50: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'msvcr100.dll'...
47e8.3b50: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.3b50: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL (rcNtResolve=0xc0150008)
47e8.3b50: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
47e8.3b50: supR3HardenedDllNotificationCallback: load 00007ff8ad840000 LB
0x0000d000 E:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [fFlags=0x0]
47e8.3b50: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll
47e8.3b50: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad840000
'E:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL'
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4270000
'C:\WINDOWS\system32\Shell32.dll'
'msvcr100.dll'.
'vboxvmm.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
'vboxddu.dll'.
'vboxdd2.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #6 'user32.dll'.
'setupapi.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #8 'ws2_32.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #9 'ole32.dll'.
'iphlpapi.dll'.
Files\Oracle\VirtualBox\VBoxDD.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxDD.dll
'iphlpapi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'iphlpapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\iphlpapi.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\IPHLPAPI.DLL) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\IPHLPAPI.DLL
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ole32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'ole32.dll' ->
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ws2_32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'ws2_32.dll' ->
'setupapi.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'user32.dll'...
'vboxdd2.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxdd2.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxdd2.dll'
'msvcr100.dll'.
Files\Oracle\VirtualBox\VBoxDD2.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxDD2.dll
'vboxddu.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxddu.dll' ->
'\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\vboxddu.dll'
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
'msvcr100.dll'...
'msvcr100.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #3 'user32.dll'.
'setupapi.dll'.
'advapi32.dll'.
Files\Oracle\VirtualBox\VBoxDDU.dll) WinVerifyTrust
Files\Oracle\VirtualBox\VBoxDDU.dll
'vboxvmm.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' ->
'msvcr100.dll'...
'advapi32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'advapi32.dll' ->
'setupapi.dll'...
'msvcr100.dll'...
Files\Oracle\VirtualBox\VBoxDD.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD2.dll
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff888820000 LB
0x00066000 E:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDDU.dll
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff86f960000 LB
0x0085c000 E:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [fFlags=0x0]
0x0003a000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff870560000 LB
0x009e1000 E:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [fFlags=0x0]
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxDD.dll
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff870560000
'E:\Program Files\Oracle\VirtualBox\VBoxDD.DLL'
Files\Oracle\VirtualBox\VBoxC.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8720c0000
'E:\Program Files\Oracle\VirtualBox\VBoxC.DLL'
Files\Oracle\VirtualBox\VBoxDD2.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff86f960000
'E:\Program Files\Oracle\VirtualBox\VBoxDD2.DLL'
47e8.94c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.94c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
47e8.94c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1
'vboxvmm.dll'.
47e8.94c: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #2 'vboxrt.dll'.
47e8.94c: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxSharedFolders.dll) WinVerifyTrust
47e8.94c: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxSharedFolders.dll
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'vboxrt.dll'...
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'vboxvmm.dll'...
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' ->
47e8.94c: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'msvcr100.dll'...
47e8.94c: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.94c: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxSharedFolders.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.94c: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
47e8.94c: supR3HardenedDllNotificationCallback: load 00007ff89ea90000 LB
0x00014000 E:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [fFlags=0x0]
47e8.94c: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll
47e8.94c: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89ea90000
'E:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL'
47e8.23f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.23f4: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
'msvcp100.dll'.
'vboxvmm.dll'.
'vboxrt.dll'.
47e8.23f4: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll) WinVerifyTrust
47e8.23f4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
47e8.23f4: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'vboxrt.dll'...
47e8.23f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'vboxvmm.dll'...
47e8.23f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxvmm.dll' ->
47e8.23f4: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on
'msvcp100.dll'...
47e8.23f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'msvcr100.dll'...
47e8.23f4: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.23f4: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL (rcNtResolve=0xc0150008)
47e8.23f4: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
47e8.23f4: supR3HardenedDllNotificationCallback: load 00007ff8ad820000 LB
0x0000c000 E:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [fFlags=0x0]
47e8.23f4: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll
47e8.23f4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ad820000
'E:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL'
47e8.1d20: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b23c0000
47e8.1d20: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #0
'msvcr100.dll'.
'msvcp100.dll'.
'vboxrt.dll'.
47e8.1d20: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll) WinVerifyTrust
47e8.1d20: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Program
Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
47e8.1d20: supR3HardenedWinVerifyCacheProcessImportTodos: Processing
'vboxrt.dll'...
47e8.1d20: supR3HardenedWinVerifyCacheProcessImportTodos: 'vboxrt.dll' ->
'msvcp100.dll'...
47e8.1d20: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcp100.dll' ->
'msvcr100.dll'...
47e8.1d20: supR3HardenedWinVerifyCacheProcessImportTodos: 'msvcr100.dll' ->
47e8.1d20: supR3HardenedMonitor_LdrLoadDll: pName=E:\Program
Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL (rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.1d20: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
47e8.1d20: supR3HardenedDllNotificationCallback: load 00007ff8ac310000 LB
0x0000d000 E:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [fFlags=0x0]
47e8.1d20: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on
\Device\HarddiskVolume3\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll
47e8.1d20: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ac310000
'E:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL'
'msvcp_win.dll'.
'rpcrt4.dll'.
'devobj.dll'.
(\Device\HarddiskVolume6\Windows\System32\MMDevAPI.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\MMDevAPI.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'devobj.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'devobj.dll' ->
'\Device\HarddiskVolume6\Windows\System32\devobj.dll' [rcNtRedir=0xc0150008]
'cfgmgr32.dll'.
(\Device\HarddiskVolume6\Windows\System32\devobj.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\devobj.dll
'msvcp_win.dll'...
'cfgmgr32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'cfgmgr32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\cfgmgr32.dll' [rcNtRedir=0xc0150008]
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDevApi.dll
[calling]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8b2df0000 LB
0x0002a000 C:\WINDOWS\System32\DEVOBJ.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8abef0000 LB
0x00072000 C:\WINDOWS\System32\MMDevApi.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8abef0000
'C:\WINDOWS\System32\MMDevApi.dll'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000f9c
pwszName=\Device\HarddiskVolume6\Windows\System32\dsound.dll
wszDigest=8184043CF3F3DF1E3CF96E74DBBF7D0836417373
Package~31bf3856ad364e35~amd64~~10.0.18362.1198.cat';
file='\Device\HarddiskVolume6\Windows\System32\dsound.dll'
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #32 'winmm.dll'.
(\Device\HarddiskVolume6\Windows\System32\dsound.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\dsound.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' ->
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\dsound.dll
[calling]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8621a0000 LB
0x00099000 C:\WINDOWS\System32\dsound.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\dsound.dll
[calling]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8621a0000
'C:\WINDOWS\System32\dsound.dll'
'C:\WINDOWS\System32\dsound.dll'
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\dsound.dll
[calling]
'C:\WINDOWS\system32\dsound.dll'
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\MMDEVAPI.DLL
(Input=MMDEVAPI.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8abef0000
'C:\WINDOWS\System32\MMDEVAPI.DLL'
'msvcp_win.dll'.
'rpcrt4.dll'.
'oleaut32.dll'.
'mmdevapi.dll'.
(\Device\HarddiskVolume6\Windows\System32\AudioSes.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\AudioSes.dll
'mmdevapi.dll'...
47e8.4480: supR3HardenedWinVerifyCacheProcessImportTodos: 'mmdevapi.dll' ->
'\Device\HarddiskVolume6\Windows\System32\mmdevapi.dll' [rcNtRedir=0xc0150008]
'oleaut32.dll'...
'rpcrt4.dll'...
'msvcp_win.dll'...
47e8.4480: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\AUDIOSES.DLL
(Input=AUDIOSES.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.4480: supR3HardenedDllNotificationCallback: load 00007ff8ac370000 LB
0x0015d000 C:\WINDOWS\System32\AUDIOSES.DLL [fFlags=0x0]
47e8.4480: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ac370000
'C:\WINDOWS\System32\AUDIOSES.DLL'
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\winmm.dll
(Input=winmm.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b0dc0000
'C:\WINDOWS\System32\winmm.dll'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fa8
pwszName=\Device\HarddiskVolume6\Windows\System32\wdmaud.drv
wszDigest=38EA8D6D625C6A0A9075DAE17FD33652FF8FC23A
file='\Device\HarddiskVolume6\Windows\System32\wdmaud.drv'
'mmdevapi.dll'.
'ksuser.dll'.
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #28 'avrt.dll'.
(\Device\HarddiskVolume6\Windows\System32\wdmaud.drv) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\wdmaud.drv
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'avrt.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'avrt.dll' ->
'\Device\HarddiskVolume6\Windows\System32\avrt.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\avrt.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\avrt.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'ksuser.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'ksuser.dll' ->
'\Device\HarddiskVolume6\Windows\System32\ksuser.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\ksuser.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\ksuser.dll
'mmdevapi.dll'...
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\wdmaud.drv
(Input=wdmaud.drv, rcNtResolve=0xc0150008) *pfFlags=0x0
0x00009000 C:\WINDOWS\SYSTEM32\ksuser.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8ac8d0000 LB
0x0000a000 C:\WINDOWS\SYSTEM32\AVRT.dll [fFlags=0x0]
0x00044000 C:\WINDOWS\System32\wdmaud.drv [fFlags=0x0]
'C:\WINDOWS\System32\wdmaud.drv'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=000000000000105c
pwszName=\Device\HarddiskVolume6\Windows\System32\msacm32.drv
wszDigest=763C5E89A8DA653902990733D245B99CC7C40BEA
file='\Device\HarddiskVolume6\Windows\System32\msacm32.drv'
'mmdevapi.dll'.
'msacm32.dll'.
'winmmbase.dll'.
(\Device\HarddiskVolume6\Windows\System32\msacm32.drv) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\msacm32.drv
'winmmbase.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmmbase.dll' ->
'\Device\HarddiskVolume6\Windows\System32\winmmbase.dll' [rcNtRedir=0xc0150008]
\Device\HarddiskVolume6\Windows\System32\winmmbase.dll
'msacm32.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'msacm32.dll' ->
'\Device\HarddiskVolume6\Windows\System32\msacm32.dll' [rcNtRedir=0xc0150008]
(\Device\HarddiskVolume6\Windows\System32\msacm32.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\msacm32.dll
'mmdevapi.dll'...
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\msacm32.drv
(Input=msacm32.drv, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8aaeb0000 LB
0x0001c000 C:\WINDOWS\SYSTEM32\MSACM32.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8aaed0000 LB
0x0000d000 C:\WINDOWS\System32\msacm32.drv [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8aaed0000
'C:\WINDOWS\System32\msacm32.drv'
47e8.758: supR3HardNtViCallWinVerifyTrustCatFile: hFile=0000000000000fd8
pwszName=\Device\HarddiskVolume6\Windows\System32\midimap.dll
wszDigest=EB34EC166C3F780657AB67E557E6C2E60C398D10
file='\Device\HarddiskVolume6\Windows\System32\midimap.dll'
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #12 'winmm.dll'.
(\Device\HarddiskVolume6\Windows\System32\midimap.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\midimap.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'winmm.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'winmm.dll' ->
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\midimap.dll
(Input=midimap.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8aac30000 LB
0x0000a000 C:\WINDOWS\System32\midimap.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8aac30000
'C:\WINDOWS\System32\midimap.dll'
[calling]
[calling]
[calling]
[calling]
[calling]
[calling]
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\WINTRUST.DLL
(Input=WINTRUST.DLL, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b41b0000
'C:\WINDOWS\System32\WINTRUST.DLL'
'C:\WINDOWS\System32\CRYPT32.dll'
47e8.758: supR3HardenedWinVerifyCacheScheduleImports: Import todo: #1 'rpcrt4.dll'.
'combase.dll'.
'shcore.dll'.
'textinputframework.dll'.
'inputhost.dll'.
'user32.dll'.
(\Device\HarddiskVolume6\Windows\System32\Windows.UI.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\Windows.UI.dll
'inputhost.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'inputhost.dll' ->
'\Device\HarddiskVolume6\Windows\System32\inputhost.dll' [rcNtRedir=0xc0150008]
'msvcp_win.dll'.
'coreuicomponents.dll'.
'propsys.dll'.
'shcore.dll'.
'win32u.dll'.
'combase.dll'.
(\Device\HarddiskVolume6\Windows\System32\InputHost.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\InputHost.dll
'textinputframework.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'textinputframework.dll'
-> '\Device\HarddiskVolume6\Windows\System32\textinputframework.dll'
\Device\HarddiskVolume6\Windows\System32\TextInputFramework.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' ->
'combase.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' ->
'combase.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'combase.dll' ->
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'win32u.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'win32u.dll' ->
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'shcore.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'shcore.dll' ->
'propsys.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'propsys.dll' ->
'\Device\HarddiskVolume6\Windows\System32\propsys.dll' [rcNtRedir=0xc0150008]
'oleaut32.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\propsys.dll) WinVerifyTrust
\Device\HarddiskVolume6\Windows\System32\propsys.dll
'coreuicomponents.dll'...
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'coreuicomponents.dll' ->
'\Device\HarddiskVolume6\Windows\System32\coreuicomponents.dll'
\Device\HarddiskVolume6\Windows\System32\CoreUIComponents.dll
47e8.758: supR3HardenedWinVerifyCacheProcessImportTodos: 'coremessaging.dll' ->
\Device\HarddiskVolume6\Windows\System32\CoreMessaging.dll
'msvcp_win.dll'...
'oleaut32.dll'...
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\System32\Windows.UI.dll
[calling]
0x000f0000 C:\Windows\System32\PROPSYS.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8a7d20000 LB
0x0011b000 C:\Windows\System32\InputHost.dll [fFlags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: load 00007ff8a7ee0000 LB
0x00151000 C:\Windows\System32\Windows.UI.dll [fFlags=0x0]
47e8.758: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8a7ee0000
'C:\Windows\System32\Windows.UI.dll'
47e8.4744: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\avrt.dll
(Input=avrt.dll, rcNtResolve=0xc0150008) *pfFlags=0x0
47e8.4744: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8ac8d0000
'C:\WINDOWS\System32\avrt.dll'
47e8.4238: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff8b4960000
'C:\WINDOWS\system32\User32.dll'
'msvcrt.dll'.
'gdi32.dll'.
'user32.dll'.
(\Device\HarddiskVolume6\Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.18362.1256_none_9e7e379be45e40e2\comctl32.dll)
WinVerifyTrust
\Device\HarddiskVolume6\Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.18362.1256_none_9e7e379be45e40e2\comctl32.dll
'user32.dll'...
\Device\HarddiskVolume6\Windows\System32\gdi32.dll
'msvcrt.dll'...
pName=C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-
(Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff89fc80000 LB
0x00284000 C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-
[fFlags=0x0]
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89fc80000
'C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.18362.1256_none_9e7e379be45e40e2\comctl32.dll'
pName=C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-
(Input=comctl32.dll, rcNtResolve=0x0) *pfFlags=0x0
47e8.47ec: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff89fc80000
'C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.18362.1256_none_9e7e379be45e40e2\comctl32.dll'
'msvcrt.dll'.
'rpcrt4.dll'.
(\Device\HarddiskVolume6\Windows\System32\WindowsCodecs.dll)
\Device\HarddiskVolume6\Windows\System32\WindowsCodecs.dll
47e8.47ec: supR3HardenedDllNotificationCallback: load 00007ff8aaa10000 LB
0x001af000 C:\WINDOWS\SYSTEM32\WindowsCodecs.dll [fFlags=0x0]
\Device\HarddiskVolume6\Windows\System32\WindowsCodecs.dll [avoiding
WinVerifyTrust]
47e8.758: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\rsaenh.dll
[calling]
47e8.758: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=1
for '\Device\HarddiskVolume6\Windows\System32\WindowsCodecs.dll'
47e8.43dc: supR3HardenedDllNotificationCallback: Unload 00007ff8a7ee0000 LB
0x00151000 C:\Windows\System32\Windows.UI.dll [flags=0x0]
47e8.43dc: supR3HardenedDllNotificationCallback: Unload 00007ff8a7d20000 LB
0x0011b000 C:\Windows\System32\InputHost.dll [flags=0x0]
[calling]
47e8.1d20: supR3HardenedDllNotificationCallback: Unload 00007ff8ac310000 LB
0x0000d000 E:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.DLL [flags=0x0]
47e8.23f4: supR3HardenedDllNotificationCallback: Unload 00007ff8ad820000 LB
0x0000c000 E:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.DLL [flags=0x0]
47e8.94c: supR3HardenedDllNotificationCallback: Unload 00007ff89ea90000 LB
0x00014000 E:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.DLL [flags=0x0]
47e8.3b50: supR3HardenedDllNotificationCallback: Unload 00007ff8ad840000 LB
0x0000d000 E:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.DLL [flags=0x0]
47e8.4238: supR3HardenedDllNotificationCallback: Unload 00007ff8ad990000 LB
0x0000f000 E:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.DLL [flags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: Unload 00007ff870560000 LB
0x009e1000 E:\Program Files\Oracle\VirtualBox\VBoxDD.DLL [flags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: Unload 00007ff888820000 LB
0x00066000 E:\Program Files\Oracle\VirtualBox\VBoxDDU.dll [flags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: Unload 00007ff86f960000 LB
0x0085c000 E:\Program Files\Oracle\VirtualBox\VBoxDD2.dll [flags=0x0]
47e8.758: supR3HardenedDllNotificationCallback: Unload 00007ff8b2560000 LB
0x0003a000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL [flags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: Unload 00007ff89f4a0000 LB
0x00014000 C:\WINDOWS\system32\wbem\wbemsvc.dll [flags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: Unload 00007ff89f4c0000 LB
0x00101000 C:\WINDOWS\system32\wbem\fastprox.dll [flags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: Unload 00007ff8a0410000 LB
0x00011000 C:\WINDOWS\system32\wbem\wbemprox.dll [flags=0x0]
47e8.47ec: supR3HardenedDllNotificationCallback: Unload 00007ff8a0380000 LB
0x00084000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [flags=0x0]
47e8.47ec: Terminating the normal way: rcExit=0
47e0.47e4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x0 (rcNtWait=0x0,
rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 4405918 ms, the end);
47c8.47cc: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x0 (rcNtWait=0x0,
rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 4406322 ms, the end);

V Box Hardening

Uploaded by

Document Informationclick to expand document information

Copyright:

Available Formats

V Box Hardening

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

V Box Hardening

Uploaded by

Copyright:

Available Formats

47c8.47cc: Log file opened: 6.1.

You might also like